Description (CNA)
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / n/a | affected n/a |
CWE
No CWE identifiers supplied.
References
- https://github.com/Netflix/security_monkey/releases/tag/v0.8.0
- http://www.securityfocus.com/bid/97088
- https://github.com/Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466
- https://github.com/Netflix/security_monkey/pull/482
ADP enrichment
No English description supplied.