SB2017050503 - Open redirect in IBM WebSphere Portal
Published: May 5, 2017 Updated: May 5, 2017
Security Bulletin ID
SB2017050503
Severity
Medium
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Open redirect (CVE-ID: CVE-2017-1156)
The vulnerability allows a remote attacker to perform phishing attacks.The weakness exists due to improper validation of user-supplied data used to redirect visitors to external pages. A remote attacker can create a specially crafted link, trick the victim into following it, spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted and obtain potentially sensitive information.
Successful exploitation of the vulnerability will allow to steal valid user's credentials and use the information to conduct further attacks.
Remediation
Install update from vendor's website.