CVE-2008-2951 Trac Open Redirect vulnerability
MediumCVSS 6.1
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pypi trac(PyPI) | < 0.10.5 | 0.10.5 |
| pypi trac(PyPI) | = 0.10 | No fix listed |
| pypi trac(PyPI) | = 0.8.4 | No fix listed |
| pypi trac(PyPI) | = 0.9 | No fix listed |
| edgewall trac | < 0.10.5 | 0.10.5 |
| fedoraproject fedora | = 8 | No fix listed |
| fedoraproject fedora | = 9 | No fix listed |
| debian/trac(Debian:13) | < 0.11-1 | 0.11-1 |
| debian/trac(Debian:14) | < 0.11-1 | 0.11-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- trac-quickjump-uri-redirect(44043) third-party-advisory vdb-entry
- github.com
- FEDORA-2008-6830 mailing-list vendor-advisory
- FEDORA-2008-6833 mailing-list vendor-advisory
- holisticinfosec.org broken-link
- trac.edgewall.org release-notes
- 46513 broken-link vdb-entry
- 30402 broken-link third-party-advisory vdb-entry
- 31314 broken-link third-party-advisory vendor-advisory
- github.com vendor-advisory
- Debian Security Tracker CVE-2008-2951 vendor-advisory