CVE-2017-7266

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

Score

CVSS 3.0 6.1 Medium

Status

Modified - cve@mitre.org

Published

2017-03-26

Last modified

2024-08-05

Weaknesses

CWE-601

Affected products

• Security Monkey (Netflix)

References

• http://www.securityfocus.com/bid/97088
• https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
• https://github.com/Netflix/security_monkey/pull/482
• https://github.com/Netflix/security_monkey/releases/tag/v0.8.0