CVE-2011-5252
published 2013-01-12CVE-2011-5252: Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows…
PriorityP431medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EXPLOIT
EPSS
11.93%
95.6th percentile
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
| orchardproject | orchard | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
Orchard 1.3.9 - 'ReturnUrl' Open Redirection
exploitdb·2012-01-04
CVE-2011-5252 Orchard 1.3.9 - 'ReturnUrl' Open Redirection
Orchard 1.3.9 - 'ReturnUrl' Open Redirection
---
source: https://www.securityfocus.com/bid/51260/info
Orchard is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.
A successful exploit may aid in phishing attacks; other attacks are possible.
Orchard 1.3.9 is vulnerable; other versions may be affected.
http://www.example.com/orchard/Users/Account/LogOff?ReturnUrl=%2f%2fwww.netsparker.com%3f
Nuclei
Orchard 'ReturnUrl' Parameter URI - Open Redirect
nuclei·CVSS 5.8
CVE-2011-5252 [MEDIUM] Orchard 'ReturnUrl' Parameter URI - Open Redirect
Orchard 'ReturnUrl' Parameter URI - Open Redirect
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
Template:
id: CVE-2011-5252
info:
name: Orchard 'ReturnUrl' Parameter URI - Open Redirect
author: ctflearner
severity: medium
description: |
Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.
impact: |
An attacker can craft a malicio
http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.htmlhttp://orchard.codeplex.com/discussions/283667http://secunia.com/advisories/47398http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/http://www.securityfocus.com/bid/51260https://exchange.xforce.ibmcloud.com/vulnerabilities/72110http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.htmlhttp://orchard.codeplex.com/discussions/283667http://secunia.com/advisories/47398http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/http://www.securityfocus.com/bid/51260https://exchange.xforce.ibmcloud.com/vulnerabilities/72110
2013-01-12
Published