FirePass 7.0 SSL VPN - 'refreshURL' Open Redirection

Author: Aung Khant
type: remote
platform: hardware
port: 
date_added: 2012-10-21
date_updated: 2015-08-25
verified: 1
codes: 
tags: 
aliases: 
screenshot_url: 
application_url: 

source: https://www.securityfocus.com/bid/56156/info

FirePass SSL VPN is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit may aid in phishing attacks; other attacks are possible.

Versions prior to FirePass 7.0.0 HF-70-7 and 6.1.0 HF-610-9 are vulnerable.

http://www.example.com/my.activation.cns.php3?langchar=&ui_translation=&refreshURL==http://attacker