Vulnerability Details : CVE-2017-5614
Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.
Vulnerability category: Open redirect
Products affected by CVE-2017-5614
- cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
- cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*
Threat overview for CVE-2017-5614
Top countries where our scanners detected CVE-2017-5614
Top open port discovered on systems with this issue
2096
IPs affected by CVE-2017-5614 210
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-5614!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-5614
0.29%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 49 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-5614
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST |
CWE ids for CVE-2017-5614
-
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-5614
-
http://www.securityfocus.com/bid/95870
cgiemail and cgiecho Multiple Security VulnerabilitiesThird Party Advisory;VDB Entry
-
http://www.openwall.com/lists/oss-security/2017/01/28/8
oss-security - Re: CVE request: cgiemail multiple vulnerabilitiesMailing List
-
https://news.cpanel.com/tsr-2017-0001-full-disclosure/
TSR-2017-0001 Full Disclosure | cPanel NewsroomVendor Advisory
Jump to