CVE-2011-5252 Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbit...
MediumCVSS 5.8
EPSS 11.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| orchardproject orchard | = 1.0 | No fix listed |
| orchardproject orchard | = 1.0.20 | No fix listed |
| orchardproject orchard | = 1.1 | No fix listed |
| orchardproject orchard | = 1.1.30 | No fix listed |
| orchardproject orchard | = 1.2 | No fix listed |
| orchardproject orchard | = 1.2.41 | No fix listed |
| orchardproject orchard | = 1.3 | No fix listed |
| orchardproject orchard | = 1.3.9 | No fix listed |
| orchardproject orchard | = 1.3.10 | No fix listed |
References
- 20120104 Open Redirection Vulnerability in Orchard 1.3.9 exploit mailing-list
- orchard.codeplex.com
- 47398 third-party-advisory vendor-advisory
- www.mavitunasecurity.com exploit
- 51260 exploit vdb-entry
- orchard-returnurl-url-redirection(72110) vdb-entry