CVE-2020-11663

Vulnerability

CA API Developer Portal versions 4.3.1 and earlier handle HTTP 404 (Not Found) page redirects in an insecure manner. This allows an attacker to craft a URL that, when visited by a user and resulting in a 404 error, redirects the user to an arbitrary external site.

Exploitation

An attacker can construct a specially crafted URL that triggers a 404 response in the portal. The attacker must trick a victim into clicking the malicious link, typically via social engineering or by embedding the link on a third-party site. No authentication or special network position is required.

Impact

A successful open redirect can be used to redirect users to malicious websites, facilitating phishing attacks or other social engineering schemes. The impact is limited to redirecting the victim's browser; no direct data compromise on the portal itself occurs.

Mitigation

Broadcom (CA Technologies) has released a fix as part of a security update. Affected customers should upgrade to a patched version of CA API Developer Portal as described in the vendor advisory [1].