Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Openx | Openx | * | 2.8.10 (including) |
| Openx | Openx | 2.8 (including) | 2.8 (including) |
| Openx | Openx | 2.8.1 (including) | 2.8.1 (including) |
| Openx | Openx | 2.8.2 (including) | 2.8.2 (including) |
| Openx | Openx | 2.8.3 (including) | 2.8.3 (including) |
| Openx | Openx | 2.8.4 (including) | 2.8.4 (including) |
| Openx | Openx | 2.8.5 (including) | 2.8.5 (including) |
| Openx | Openx | 2.8.6 (including) | 2.8.6 (including) |
| Openx | Openx | 2.8.7 (including) | 2.8.7 (including) |
| Openx | Openx | 2.8.8 (including) | 2.8.8 (including) |
| Openx | Openx | 2.8.9 (including) | 2.8.9 (including) |
References
- http://packetstormsecurity.com/files/128718/OpenX-2.8.10-Open-Redirect.html
- http://seclists.org/fulldisclosure/2014/Oct/72
- http://www.tetraph.com/blog/cves/cve-2014-2230-openx-open-redirect-vulnerability-2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97621
- http://packetstormsecurity.com/files/128718/OpenX-2.8.10-Open-Redirect.html
- http://seclists.org/fulldisclosure/2014/Oct/72
- http://www.tetraph.com/blog/cves/cve-2014-2230-openx-open-redirect-vulnerability-2
- https://exchange.xforce.ibmcloud.com/vulnerabilities/97621