CVE-2017-5571 - Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License

CVE-2017-5571

Summary

Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.

References

Vulnerable Configurations

cpe:2.3:a:flexerasoftware:flexnet_publisher:11.10:*:*:*:*:*:*:*
cpe:2.3:a:flexerasoftware:flexnet_publisher:11.10:*:*:*:*:*:*:*
cpe:2.3:a:flexerasoftware:flexnet_publisher:11.13.1.0:*:*:*:*:*:*:*
cpe:2.3:a:flexerasoftware:flexnet_publisher:11.13.1.0:*:*:*:*:*:*:*

CVSS

Base:	5.8 (as of 30-05-2018 - 01:29)
Impact:
Exploitability:

CWE

CWE-601

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

refmap via4

bid	96028
confirm	https://support.citrix.com/article/CTX219885 https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager https://www.schneider-electric.com/en/download/document/SEVD-2018-137-01/ https://www.schneider-electric.com/en/download/document/SEVD-2018-144-01/
misc	https://ics-cert.us-cert.gov/advisories/ICSA-18-144-01

Last major update

30-05-2018 - 01:29

Published

03-03-2017 - 15:59

Last modified

30-05-2018 - 01:29