CVE-2014-2213

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

Open redirect vulnerability in the password reset functionality in POSH 3.0 through 3.2.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the redirect parameter to portal/scr_sendmd5.php.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/oss-sec/2014/q1/444Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/65843Third Party Advisory, VDB Entry
https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/Exploit, Third Party Advisory
http://seclists.org/oss-sec/2014/q1/444Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/65843Third Party Advisory, VDB Entry
https://sysdream.com/news/lab/posh-3-2-1-multiple-vulnerabilities/Exploit, Third Party Advisory

Timeline

Published: Nov 22, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-22146.1Multiple cross-site scripting (XSS) vulnerabilities in POSH (aka Posh portal or Portaneo) 3.0 through 3.2.1 allow remote attackers to inject CVE-2014-22167.5The FortiManager protocol service in Fortinet FortiOS before 4.3.16 and 5.0.0 before 5.0.8 on FortiGate devices allows remote attackers to c CVE-2014-22177.5Absolute path traversal vulnerability in the RadAsyncUpload control in the RadControls in Telerik UI for ASP.NET AJAX before Q3 2012 SP2 all CVE-2014-22194.3Cross-site scripting (XSS) vulnerability in whizzywig/wb.php in CMSimple Classic 3.54 and earlier, possibly as downloaded before February 26 CVE-2014-22237.5Unrestricted file upload vulnerability in plog-admin/plog-upload.php in Plogger 1.0 RC1 and earlier allows remote authenticated users to exe CVE-2014-22245.0Plogger 1.0 RC1 and earlier, when the Lucid theme is used, does not assign new values for certain codes, which makes it easier for remote at CVE-2014-22258.8Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hija CVE-2014-22262.6Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to CVE-2014-22276.0The default Flash cross-domain policy (crossdomain.xml) in Ubiquiti Networks UniFi Video (formerly AirVision aka AirVision Controller) befor CVE-2014-22289.8The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML m CVE-2014-22305.8Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to a CVE-2014-22314.3Cross-site scripting (XSS) vulnerability in the API in synetics i-doit pro before 1.2.5 allows remote attackers to inject arbitrary web scri