CVE-2011-5252

43Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 12%

from disclosure to weapon0 days

Published on NVDJan 12

1st PoCJan 4

exploitation probability

12%top 4% of all CVEs

observed exploitation

nono source reports it

1 public exploit(s)

Open redirect vulnerability in Users/Account/LogOff in Orchard 1.0.x before 1.0.21, 1.1.x before 1.1.31, 1.2.x before 1.2.42, and 1.3.x before 1.3.10 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the ReturnUrl parameter.

Affected products

n/a · n/a

public PoCs found — 1✓ VexDay Proof

exploitdb✓ VexDay Proofwww.exploit-db.com/exploits/36493

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://archives.neohapsis.com/archives/bugtraq/2012-01/0023.html http://orchard.codeplex.com/discussions/283667 http://secunia.com/advisories/47398 https://exchange.xforce.ibmcloud.com/vulnerabilities/72110 http://www.mavitunasecurity.com/open-redirection-vulnerability-in-orchard/http://www.securityfocus.com/bid/51260