6.1med
CVE-2017-7266
Netflix Security Monkey Open Redirect vulnerability
Also known as GHSA-j6jq-3q8p-xgg6, PYSEC-2026-919
Published 9 y ago · modified 4 mo ago · JSON
CVSS
6.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.0%
percentile 62%
Public exploits
0
none known
Summary
Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.
Exploit prediction (EPSS)
0.97% probability of exploitation in the next 30 days, higher than 62% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 5.8 | AV:N/AC:M/Au:N/C:P/I:P/A:N |
| OSV | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.0 | 6.1 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pypi | security-monkey | <0.8.0 | 0.8.0 |
Classification
- Weakness
- CWE-601 URL Redirection to Untrusted Site
References
- github.com /Netflix/security_monkey/releases/tag/v0.8.0 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/97088 · vdb-entry, x_refsource_BID, x_transferred
- github.com /Netflix/security_monkey/commit/3b4da13efabb05970c80f464a50d3c1c12262466 · x_refsource_CONFIRM, x_transferred
- github.com /Netflix/security_monkey/pull/482 · x_refsource_CONFIRM, x_transferred
- nvd.nist.gov /vuln/detail/CVE-2017-7266 · advisory
- github.com /Netflix/security_monkey · package
- web.archive.org /web/20201220170714/http://www.securityfocus.com/bid/97088 · web
- pypi.org /project/security-monkey · package
- github.com /advisories/GHSA-j6jq-3q8p-xgg6 · advisory
Sources
- CVE List: CVE-2017-7266
- GitHub Advisory: GHSA-j6jq-3q8p-xgg6
- NVD: CVE-2017-7266
- OSV: PYSEC-2026-919
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.