Phishers can redirect users to an untrusted site

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP2 (5.2.6)
• Fix Version/s: 5.1 EE SP5 (5.1.8), 5.2 EE SP3 (5.2.7)
• Component/s: Application Security
• Labels:
  • 5.2_release_notes
• Environment: All

By altering the redirect parameters in an URL, a phisher can send an unsuspecting user to a malicious site when they hit certain return links or cancel buttons. Such actions should redirect only to the same IP or authorized IP addresses defined in portal(-ext).properties.