IBM Operational Decision Manager HTTP open redirect
IBM Operational Decision Manager 8.11.0.1, 8.11.1.0, 8.12.0.1, 9.0.0.1, and 9.5.0 could allow a remote attacker to conduct phishing attacks, using an open redirect attack. By persuading a victim to visit a specially crafted Web site, a remote attacker could exploit this vulnerability to spoof the URL displayed to redirect a user to a malicious Web site that would appear to be trusted. This could allow the attacker to obtain highly sensitive information or conduct further attacks against the victim.
Problem Types
| Type | CWE ID | Description |
|---|
| CWE | CWE-601 | CWE-601 URL Redirection to Untrusted Site ('Open Redirect') |
Type: CWE
Description: CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
Metrics
| Version | Base score | Base severity | Vector |
|---|
| 3.1 | 7.4 | HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N |
Version: 3.1
Base score: 7.4
Base severity: HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N