CVE-2015-3898 EXPLOIT
6.1
MEDIUM · CVSS 3.0 · EPSS 5.8% (pctl 93)
Patch early
A public exploit exists.
Description
Multiple open redirect vulnerabilities in Bonita BPM Portal before 6.5.3 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via vectors involving the redirectUrl parameter to (1) bonita/login.jsp or (2) bonita/loginservice.
Scoring
| CVSS | 6.1 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 5.84% — more likely to be exploited than 93% of all CVEs |
| Weakness | CWE-601 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2018-02-28 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| bonitasoft | bonita bpm portal |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Bonita BPM 6.5.1 - Multiple Vulnerabilities | 2015-06-10 |
References
- http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
- http://www.securityfocus.com/archive/1/535733/100/0/threaded
- https://www.htbridge.com/advisory/HTB23259
- http://packetstormsecurity.com/files/132237/Bonita-BPM-6.5.1-Directory-Traversal-Open-Redirect.html
- http://www.securityfocus.com/archive/1/535733/100/0/threaded
- https://www.htbridge.com/advisory/HTB23259
→ the Explorer · watch your stack · NVD