| Vulnerability Name: | CCN-79495 | ||||||
| Published: | 2012-10-21 | ||||||
| Updated: | 2012-10-21 | ||||||
| Summary: | FirePass SSL VPN could allow a remote attacker to conduct phishing attacks, caused by an error in the my.activation.cns.php script. An attacker could exploit this vulnerability using the refreshURL parameter in a specially-crafted URI to redirect a victim to arbitrary Web sites. | ||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
| ||||||
| CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N) 3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
| ||||||
| Vulnerability Consequences: | Gain Access | ||||||
| References: | Source: CCN Type: Packetstorm Security Website F5 FirePass SSL VPN Open URL Redirection Source: CCN Type: SA51045 F5 FirePass SQL Injection and Redirection Vulnerabilities Source: CCN Type: BID-56156 FirePass SSL VPN 'refreshURL' Parameter URI Redirection Vulnerability Source: XF Type: UNKNOWN firepass-sslvpn-uri-redirection(79495) Source: CCN Type: F5 Networks Web site FirePass SSL VPN Products | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||