CVE-2020-11665

Vulnerability

CVE-2020-11665 is an open redirect vulnerability in the CA API Developer Portal, affecting versions 4.3.1 and earlier. The flaw exists in the loginRedirect page, where redirects are handled in an insecure manner [1]. An attacker can craft a URL that leverages this page to redirect a user to an arbitrary external site.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious URL that uses the loginRedirect endpoint to redirect unsuspecting users to an attacker-controlled external site. The attacker does not require authentication or any special privileges to carry out the attack [1]. The victim must simply click on the crafted link.

Impact

Successful exploitation allows an attacker to perform an open redirect attack. This can be leveraged for phishing campaigns, where a user trusts the legitimate portal domain and is then redirected to a malicious site, potentially leading to credential theft or malware installation. The risk rating for this CVE is Low [1].

Mitigation

Broadcom (CA Technologies) has published a security notice and recommends that affected customers implement the provided solutions [1]. While the specific patch version is not listed in the available references, users should upgrade to a fixed version as per vendor guidance. No workaround is disclosed.