CVE-2017-1287
Last modified
CVE-2017-1287 is a vulnerability of currently unknown severity. IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially-crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Ibm | Rhapsody Design Manager | 5.0 |
| Ibm | Rhapsody Design Manager | 5.0.1 |
| Ibm | Rhapsody Design Manager | 5.0.2 |
| Ibm | Rhapsody Design Manager | 6.0 |
| Ibm | Rhapsody Design Manager | 6.0.1 |
| Ibm | Rhapsody Design Manager | 6.0.2 |
| Ibm | Rhapsody Design Manager | 6.0.3 |
References
- http://www.ibm.com/support/docview.wss?uid=swg22006052Patch, Vendor Advisory
- http://www.ibm.com/support/docview.wss?uid=swg22006052Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-1287?
How severe is CVE-2017-1287?
How do I fix CVE-2017-1287?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-12863In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function PxMD…8.8
- CVE-2017-12864In opencv/modules/imgcodecs/src/grfmt_pxm.cpp, function Read…8.8
- CVE-2017-12865Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 …9.8
- CVE-2017-12867The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp …
- CVE-2017-12868The secureCompare method in lib/SimpleSAML/Utils/Crypto.php …
- CVE-2017-12869The multiauth module in SimpleSAMLphp 1.14.13 and earlier al…
- CVE-2017-12870SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-…
- CVE-2017-12871The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in …
- CVE-2017-12872The (1) Htpasswd authentication source in the authcrypt modu…
- CVE-2017-12873SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to…
- CVE-2017-12874The InfoCard module 1.0 for SimpleSAMLphp allows attackers t…
- CVE-2017-12875The WritePixelCachePixels function in ImageMagick 7.0.6-6 al…
Are you affected by CVE-2017-1287?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST