‹ Back to list

CVE-2017-1000027

Status: ModifiedMedium (6.1)—
Severity6.1Medium · CVSS 3.0
Exploitation probability1.16 %higher than 67% of CVEs
Active exploitationNonot in the CISA catalog
Public exploitNot knownno public code found

Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access.

CVSS

Base score
6.1
Version
3.0
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days
1.16 %
Percentile among all scored CVEs
67
Score date
10/20/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Koozali — SME Server

CWEs

References

Show 4 references

Raw JSON (NVD)

Show
{
  "id": "CVE-2017-1000027",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-07-17T13:18:16.767",
  "references": [
    {
      "url": "https://cp270.wordpress.com/2017/02/02/security-advisory-open-url-redirect-in-sme-server/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://forums.contribs.org/index.php/topic%2C52838.0.html",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://cp270.wordpress.com/2017/02/02/security-advisory-open-url-redirect-in-sme-server/",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://forums.contribs.org/index.php/topic%2C52838.0.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Koozali Foundation SME Server versions 8.x, 9.x, 10.x are vulnerable to an open URL redirect vulnerability in the user web login function resulting in unauthorized account access."
    },
    {
      "lang": "es",
      "value": "Las versiones 8.x, 9.x, 10.x de Koozali Foundation SME Server, son susceptibles a una vulnerabilidad de redireccionamiento URL abierto en la función user web login, resultando en un acceso no autorizado a la cuenta."
    }
  ],
  "lastModified": "2026-06-17T00:58:36.720",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:koozali:sme_server:8.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1A6786B7-D62B-4BC0-BDA8-F2C2E830492C"
            },
            {
              "criteria": "cpe:2.3:a:koozali:sme_server:9.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2B204F03-3150-46B7-88F5-746E85A47DE5"
            },
            {
              "criteria": "cpe:2.3:a:koozali:sme_server:9.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67B9C2DA-9907-4378-9E44-3013A21A282F"
            },
            {
              "criteria": "cpe:2.3:a:koozali:sme_server:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B26F0530-608D-4F2D-BEF2-67C0FF0BA5F6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}