FirePass 7.0 SSL VPN - 'refreshURL' Open Redirection

Author: Aung Khant
type: remote
platform: hardware
port: 
date_added: 2012-10-21 
date_updated: 2015-08-25 
verified: 1 
codes:  
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/56156/info

FirePass SSL VPN is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable.

http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker