medium6.1
CVE-2017-7266
Netflix Security Monkey before 0.8.0 has an Open Redirect.
Impact
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Netflix | Security Monkey | through 0.7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/97088
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
- https://github.com/Netflix/security_monkey/pull/482
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0
- http://www.securityfocus.com/bid/97088
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
- https://github.com/Netflix/security_monkey/pull/482
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0