CVE-2008-2951 Trac Open Redirect vulnerability
Remote attackers can redirect users to arbitrary websites via the search script, facilitating phishing attacks against Trac users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2008-2951?
CVE-2008-2951 is a medium-severity vulnerability in Fedoraproject Fedora, published on 27 Jul 2008. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.
Weakness: CWE-601
Which versions are affected by CVE-2008-2951?
3 open source packages ship an affected version, including trac. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
trac PyPI | All versions | 0.10.5 |
trac PyPI | All versions | 0.10.5 |
trac PyPI | All versions | 0.10.5 |
Products include Edgewall Trac, Fedoraproject Fedora.
How do I fix CVE-2008-2951?
Upgrade trac to 0.10.5 or later.
Is CVE-2008-2951 being exploited?
There is no known exploitation of CVE-2008-2951 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2008-2951, GHSA-rcmj-xp8f-f6q4, PYSEC-2008-4.