Detections
Analytics
CGI Generic Open Redirection
medium Nessus Plugin ID 47834
Language:
Synopsis
A web application is potentially vulnerable to uncontrolled redirection.Description
By providing specially crafted parameters to CGIs, Nessus was able to redirect to a third-party website.As redirections are commonly used, it is possible that users will be unaware that something abnormal is happening.
This kind of attack can be used to steal confidential data, typically credentials (phishing).
Solution
Modify the relevant CGIs so that they properly escape arguments.See Also
https://en.wikipedia.org/wiki/URL_redirection#Manipulating_visitors
Plugin Details
Severity: Medium
ID: 47834
File Name: torture_cgi_redirection.nasl
Version: 1.20
Type: remote
Family: CGI abuses
Published: 7/26/2010
Updated: 1/19/2021
Supported Sensors: Nessus
Risk Information
CVSS v2
Risk Factor: Medium
Base Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:N/A:N
Vulnerability Information
Required KB Items: Settings/enable_web_app_tests