var-201703-0722
Vulnerability from variot
Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Citrix License Server for Windows and License Server VPX are products of Citrix Systems. The former is a Windows-based authentication server, and the latter is an authentication server device. The attacker exploited the vulnerability to execute a specially crafted URI and induced user clicks. When the user clicks on the link, they are redirected to the attacker-controlled website, causing a phishing attack. Other attacks are possible
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201703-0722", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "flexnet publisher", "scope": "lte", "trust": 1.0, "vendor": "flexerasoftware", "version": "11.14.1" }, { "model": "flexnet publisher", "scope": "lte", "trust": 0.8, "vendor": "flexera", "version": "11.14.1" }, { "model": "license server for windows", "scope": "lte", "trust": 0.6, "vendor": "citrix", "version": "\u003c=11.14.0.1" }, { "model": "license server vpx", "scope": "lte", "trust": 0.6, "vendor": "citrix", "version": "\u003c=11.14.0.1" }, { "model": "flexnet publisher", "scope": "eq", "trust": 0.6, "vendor": "flexerasoftware", "version": "11.14.1" }, { "model": "flexnet publisher", "scope": "eq", "trust": 0.3, "vendor": "flexera", "version": "11.14.1" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.9" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.6" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.5" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.14.0.1" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.13.1.2" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.12" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.11" }, { "model": "license server vpx", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.10" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.11.1" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.9" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.6" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.5" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.14.0.1" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.13.1.2" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.12" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.11" }, { "model": "license server for windows", "scope": "eq", "trust": 0.3, "vendor": "citrix", "version": "11.10" }, { "model": null, "scope": "eq", "trust": 0.2, "vendor": "flexnet publisher", "version": "*" } ], "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "BID", "id": "96028" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:flexerasoftware:flexnet_publisher:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "11.14.1", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2017-5571" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Jan Rude", "sources": [ { "db": "BID", "id": "96028" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ], "trust": 0.9 }, "cve": "CVE-2017-5571", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "impactScore": 4.9, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": true, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 5.8, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2017-5571", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.8, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "CNVD", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "CNVD-2017-01545", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.6, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "IVD", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.2, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.9 [IVD]" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitabilityScore": 2.8, "impactScore": 2.7, "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "trust": 1.0, "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "None", "baseScore": 6.1, "baseSeverity": "Medium", "confidentialityImpact": "Low", "exploitabilityScore": null, "id": "CVE-2017-5571", "impactScore": null, "integrityImpact": "Low", "privilegesRequired": "None", "scope": "Changed", "trust": 0.8, "userInteraction": "Required", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2017-5571", "trust": 1.8, "value": "MEDIUM" }, { "author": "CNVD", "id": "CNVD-2017-01545", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201702-207", "trust": 0.6, "value": "MEDIUM" }, { "author": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74", "trust": 0.2, "value": "MEDIUM" } ] } ], "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Open redirect vulnerability in the lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) 11.14.1 and earlier, as used in Citrix License Server for Windows and the Citrix License Server VPX, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. Citrix License Server for Windows and License Server VPX are products of Citrix Systems. The former is a Windows-based authentication server, and the latter is an authentication server device. The attacker exploited the vulnerability to execute a specially crafted URI and induced user clicks. When the user clicks on the link, they are redirected to the attacker-controlled website, causing a phishing attack. Other attacks are possible", "sources": [ { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "BID", "id": "96028" }, { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" } ], "trust": 2.61 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2017-5571", "trust": 3.5 }, { "db": "BID", "id": "96028", "trust": 2.5 }, { "db": "ICS CERT", "id": "ICSA-18-144-01", "trust": 1.8 }, { "db": "SCHNEIDER", "id": "SEVD-2018-137-01", "trust": 1.0 }, { "db": "SCHNEIDER", "id": "SEVD-2018-144-01", "trust": 1.0 }, { "db": "CNVD", "id": "CNVD-2017-01545", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201702-207", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2017-002122", "trust": 0.8 }, { "db": "IVD", "id": "9FF100A5-A25A-47CC-A9F4-725B8FF0FB74", "trust": 0.2 } ], "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "BID", "id": "96028" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "id": "VAR-201703-0722", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" } ], "trust": 1.24806255 }, "iot_taxonomy": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "category": [ "ICS" ], "sub_category": null, "trust": 0.8 } ], "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" } ] }, "last_update_date": "2023-12-18T11:32:57.483000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "CTX219885", "trust": 0.8, "url": "https://support.citrix.com/article/ctx219885" }, { "title": "Top Page", "trust": 0.8, "url": "http://www.flexerasoftware.jp/producer/" }, { "title": "Patch for the Citrix License Server for Windows and License Server VPX Open Redirection Vulnerability", "trust": 0.6, "url": "https://www.cnvd.org.cn/patchinfo/show/89488" }, { "title": "Citrix License Server for Windows and License Server VPX Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=67511" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-601", "trust": 1.8 } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.2, "url": "http://www.securityfocus.com/bid/96028" }, { "trust": 1.9, "url": "https://support.citrix.com/article/ctx219885" }, { "trust": 1.0, "url": "https://ics-cert.us-cert.gov/advisories/icsa-18-144-01" }, { "trust": 1.0, "url": "https://www.citect.schneider-electric.com/safety-and-security-central/36-security-notifications/9134-vulnerabilities-within-schneider-electric-floating-license-manager" }, { "trust": 1.0, "url": "https://www.schneider-electric.com/en/download/document/sevd-2018-137-01/" }, { "trust": 1.0, "url": "https://www.schneider-electric.com/en/download/document/sevd-2018-144-01/" }, { "trust": 0.8, "url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5571" }, { "trust": 0.8, "url": "https://www.us-cert.gov/ics/advisories/icsa-18-144-01" }, { "trust": 0.8, "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2017-5571" }, { "trust": 0.3, "url": "http://www.citrix.com" } ], "sources": [ { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "BID", "id": "96028" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" }, { "db": "BID", "id": "96028" }, { "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "db": "NVD", "id": "CVE-2017-5571" }, { "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-02-18T00:00:00", "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "date": "2017-02-20T00:00:00", "db": "CNVD", "id": "CNVD-2017-01545" }, { "date": "2017-02-06T00:00:00", "db": "BID", "id": "96028" }, { "date": "2017-03-29T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "date": "2017-03-03T15:59:00.883000", "db": "NVD", "id": "CVE-2017-5571" }, { "date": "2017-02-09T00:00:00", "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2017-02-18T00:00:00", "db": "CNVD", "id": "CNVD-2017-01545" }, { "date": "2017-03-07T01:01:00", "db": "BID", "id": "96028" }, { "date": "2019-07-10T00:00:00", "db": "JVNDB", "id": "JVNDB-2017-002122" }, { "date": "2018-05-30T01:29:01.017000", "db": "NVD", "id": "CVE-2017-5571" }, { "date": "2017-03-06T00:00:00", "db": "CNNVD", "id": "CNNVD-201702-207" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201702-207" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Citrix License Server for Windows and License Server VPX Open redirection vulnerability", "sources": [ { "db": "IVD", "id": "9ff100a5-a25a-47cc-a9f4-725b8ff0fb74" }, { "db": "CNVD", "id": "CNVD-2017-01545" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "lack of information", "sources": [ { "db": "CNNVD", "id": "CNNVD-201702-207" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.