medium6.1Public exploit code
CVE-2015-3898
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing a…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Bonita BPM 6.5.1 - Multiple Vulnerabilities2015-06-10 · webapps · jsp · Verified
Impact
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Bonitasoft | Bonita Bpm Portal | before 6.5.3 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
- http://www.securityfocus.com/archive/1/535733/100/0/threaded
- https://www.htbridge.com/advisory/HTB23259
- http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
- http://www.securityfocus.com/archive/1/535733/100/0/threaded
- https://www.htbridge.com/advisory/HTB23259