CVE-2011-5252

EPSS 11.9%

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 11.9%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

04 Jan 2012Public PoC

12 Jan 2013Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.

Affected products

n/a · n/a

public PoCs found — 1

exploitdbwww.exploit-db.com/exploits/36493unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.html http://orchard.codeplex.com/discussions/283667 http://secunia.com/advisories/47398 https://exchange.xforce.ibmcloud.com/vulnerabilities/72110 http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/http://www.securityfocus.com/bid/51260