Nokia Electronic Documentation Redirection Vulnerability

vendor:

NED

by:

SecurityFocus

6.4

CVSS

MEDIUM

Redirection Vulnerability

601

CWE

Product Name: NED

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: Yes

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Nokia Electronic Documentation Redirection Vulnerability

A vulnerability has been discovered in Nokia Electronic Documentation (NED) that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided within specific HTTP requests. As a result, an attacker may be capable of making a request that would cause data to be redirected to a third party system. This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets.

Mitigation:

The vendor has released a patch to address this issue.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8625/info

A vulnerability has been discovered in Nokia Electronic Documentation (NED) that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided within specific HTTP requests. As a result, an attacker may be capable of making a request that would cause data to be redirected to a third party system.

This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets.

http://www.example.org/docs/NED?action=retrieve&location=http://www.target.com/