Vulnerability Details : CVE-2012-5647
Open redirect vulnerability in node-util/www/html/restorer.php in Red Hat OpenShift Origin before 1.0.5-3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the PATH_INFO.
Vulnerability category: Open redirectInput validation
Exploit prediction scoring system (EPSS) score for CVE-2012-5647
Probability of exploitation activity in the next 30 days: 0.41%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 70 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-5647
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST |
CWE ids for CVE-2012-5647
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-5647
-
https://github.com/openshift/origin-server/pull/1017
Fix for Bug 880699 by jwhonce · Pull Request #1017 · openshift/origin-server · GitHub
-
http://www.securityfocus.com/bid/57189
Red Hat OpenShift Origin Command Execution and Open Redirection Vulnerabilities
-
https://bugzilla.redhat.com/show_bug.cgi?id=888523
888523 – (CVE-2012-5647) CVE-2012-5647 openshift-origin-node-util: restorer.php arbitrary URL redirection
-
http://rhn.redhat.com/errata/RHSA-2013-0148.html
RHSA-2013:0148 - Security Advisory - Red Hat Customer Portal
-
https://github.com/openshift/origin-server/commit/32564a0839b1517d762afab2013c26c0959bac00
Fix for Bug 880699 · openshift/origin-server@32564a0 · GitHubExploit;Patch
Products affected by CVE-2012-5647
- cpe:2.3:a:redhat:openshift:1.0:-:enterprise:*:*:*:*:*
- cpe:2.3:a:redhat:openshift_origin:*:*:*:*:*:*:*:*