Netflix Security Monkey Open Redirect vulnerability

MITTEL 6.1CVE-2017-7266 · GHSA-j6jq-3q8p-xgg6 · PYSEC-2026-919 · Published 26/03/2017 · updated 17/06/2026

Kurz gesagt

CVE-2017-7266 ist eine Schwachstelle (MITTEL (CVSS 6.1)) in security-monkey, security monkey (netflix).
Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.97%, höher als bei 61.7% aller Schwachstellen.
Abhilfe: auf 0.8.0 oder neuer aktualisieren.

Package	Affected versions	Patched versions
security-monkey PyPI	`< 0.8.0`	`0.8.0`
security monkey netflix	`≤ 0.7.0`	No fix yet

Description

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

NVD description

Netflix Security Monkey before 0.8.0 has an Open Redirect. The logout functionality accepted the "next" parameter which then redirects to any domain irrespective of the Host header.

References

nvd.nist.gov/vuln/detail/CVE-2017-7266 · ADVISORY
Netflix/security_monkey#482 · WEB
Netflix/security_monkey commit 3b4da13 · WEB
Netflix/security_monkey · PACKAGE
Netflix/security_monkey release v0.8.0 · WEB
web.archive.org/web/20201220170714/http://www.securityfocus.com/bid/97088 · WEB
securityfocus.com/bid/97088
pypi.org/project/security-monkey · PACKAGE
GitHub Advisory GHSA-j6jq-3q8p-xgg6 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free