QwikSec

Security Database

CVE

CWE

Training

CVE-2014-1985

Published: Apr 11, 2014

Modified: Aug 6, 2024

PUBLISHED

Description

Open redirect vulnerability in the redirect_back_or_default function in app/controllers/application_controller.rb in Redmine before 2.4.5 and 2.5.x before 2.5.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the back url (back_url parameter).

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

JVNDB-2014-000041

third-party-advisory

x_refsource_JVNDB

http://www.redmine.org/projects/redmine/wiki/Changelog

x_refsource_CONFIRM

third-party-advisory

x_refsource_JVN

https://github.com/redmine/redmine/commit/7567c3d8b21fe67e5f04e6839c1fce061600f2f3

x_refsource_CONFIRM

[oss-security] 20140410 Re: CVE request: redmine open redirector

mailing-list

x_refsource_MLIST

vdb-entry

x_refsource_BID

http://www.redmine.org/projects/redmine/wiki/Security_Advisories

x_refsource_CONFIRM

third-party-advisory

x_refsource_SECUNIA

http://www.redmine.org/projects/redmine/wiki/Changelog_2_4

x_refsource_CONFIRM

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.