medium6.1
CVE-2020-8430
Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal.
Impact
Stormshield Network Security 310 3.7.10 devices have an auth/lang.html?rurl= Open Redirect vulnerability on the captive portal. For example, the attacker can use rurl=//example.com instead of rurl=https://example.com in the query string.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Stormshield | Stormshield Network Security | from 3.0.0 through 3.7.10 from 3.8.0 through 3.10.0 from 4.0.0 through 4.0.1 |
Weakness classification
References
- NVD record
- CVE.org record
- https://advisories.stormshield.eu/2020-001/
- https://www.digitemis.com/2020/02/24/digitemis-decouvre-une-vulnerabilite-au-sein-dun-produit-stormshield-cve-2020-8430/
- https://www.digitemis.com/category/blog/actualite/
- https://www.stormshield.com/products/sn310/
- https://advisories.stormshield.eu/2020-001/
- https://www.digitemis.com/2020/02/24/digitemis-decouvre-une-vulnerabilite-au-sein-dun-produit-stormshield-cve-2020-8430/
- https://www.digitemis.com/category/blog/actualite/
- https://www.stormshield.com/products/sn310/