CVE-2013-1093

2013-06-1711:38:48

CWE-20

[email protected]

web.nvd.nist.gov

cve-2013-1093

open redirect

vulnerability

zcc-framework.jar

novell zenworks configuration management

zcm 11.2

6.8 Medium

AI Score

Confidence

Low

5.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

0.003 Low

EPSS

Percentile

70.1%

JSON

Open redirect vulnerability in the fwdToURL function in the ZCC login page in zcc-framework.jar in Novell ZENworks Configuration Management (ZCM) 11.2 before 11.2.3a Monthly Update 1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via the directToPage parameter.

Affected configurations

NVD

Node

novellzenworks_configuration_managementMatch11.2

novellzenworks_configuration_managementMatch11.2.1

novellzenworks_configuration_managementMatch11.2.2

novellzenworks_configuration_managementMatch11.2.3

CPENameOperatorVersion
novell:zenworks_configuration_managementnovell zenworks configuration managementeq11.2
novell:zenworks_configuration_managementnovell zenworks configuration managementeq11.2.1
novell:zenworks_configuration_managementnovell zenworks configuration managementeq11.2.2
novell:zenworks_configuration_managementnovell zenworks configuration managementeq11.2.3

CPE	Name	Operator	Version
novell:zenworks_configuration_management	novell zenworks configuration management	eq	11.2
novell:zenworks_configuration_management	novell zenworks configuration management	eq	11.2.1
novell:zenworks_configuration_management	novell zenworks configuration management	eq	11.2.2
novell:zenworks_configuration_management	novell zenworks configuration management	eq	11.2.3