« Volver al listado

CVE-2017-5614

Estado: ModificadaMedia (6.1)—

Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cpanel — Cpanel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-5614",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 4.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-03-03T15:59:00.960",
  "references": [
    {
      "url": "http://www.openwall.com/lists/oss-security/2017/01/28/8",
      "tags": [
        "Mailing List"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/95870",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://news.cpanel.com/tsr-2017-0001-full-disclosure/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2017/01/28/8",
      "tags": [
        "Mailing List"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/95870",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://news.cpanel.com/tsr-2017-0001-full-disclosure/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Open redirect vulnerability in cgiemail and cgiecho allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the (1) success or (2) failure parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de redirección abierta en cgiemail y cgiecho permite a atacantes remotos redirigir a usuarios a sitios web arbitrarios y llevar a cabo ataques de phishing a través de vectores que involucran el parámetro (1) success o (2) failure."
    }
  ],
  "lastModified": "2026-06-17T01:20:50.997",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA4B4DFA-B2D7-4EA7-A94A-8F60027FD024",
              "versionEndExcluding": "11.54.0.36",
              "versionStartIncluding": "11.54.0.0"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D11E1492-C7CE-42BA-A721-1163B4C9EA22",
              "versionEndExcluding": "56.0.43",
              "versionStartIncluding": "55.9999.61"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8193ADD4-1299-49BA-AE70-F515F12D01D0",
              "versionEndExcluding": "58.0.43",
              "versionStartIncluding": "57.9999.48"
            },
            {
              "criteria": "cpe:2.3:a:cpanel:cpanel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EBCB32F8-DE9E-4C6E-9F5B-1629E53936B0",
              "versionEndExcluding": "60.0.35",
              "versionStartIncluding": "59.9999.58"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}