id: CVE-2018-14931 info: name: Polarisft Intellect Core Banking Software Version 9.7.1 - Open Redirect author: 0x_Akoko severity: medium description: Polarisft Intellect Core Banking Software Version 9.7.1 is susceptible to an open redirect issue in the Core and Portal modules via the /IntellectMain.jsp?IntellectSystem= URI. remediation: | Apply the latest security patches or updates provided by Polarisft to fix the open redirect vulnerability. reference: - https://neetech18.blogspot.com/2019/03/polaris-intellect-core-banking-software_31.html - https://nvd.nist.gov/vuln/detail/CVE-2018-14931 classification: cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2018-14931 cwe-id: CWE-601 epss-score: 0.00118 epss-percentile: 0.45536 cpe: cpe:2.3:a:polarisft:intellect_core_banking:9.7.1:*:*:*:*:*:*:* metadata: max-request: 1 vendor: polarisft product: intellect_core_banking tags: cve,cve2018,redirect,polarisft,intellect http: - method: GET path: - '{{BaseURL}}/IntellectMain.jsp?IntellectSystem=https://www.interact.sh' matchers: - type: regex part: header regex: - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1