CVE:CVE-2008-2951
CNNVD:CNNVD-200807-416
Trac是Edgewall公司开发并维护的开放源码网页界面专案管理、缺陷追踪软件。
Trac 0.10.5之前的版本中的搜索脚本存在开放重定向漏洞。远程攻击者可以借助q参数中的一个URL，重新引导用户到任意网站和执行钓鱼攻击。q参数可能涉及quickjump函数。
solution:Upgrade trac trac to a higher version than 0.10.4,0.5,0.5.1,0.5.2,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.8.3,0.8.4,0.9,0.9:b1,0.9:b2,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.10,0.10.1,0.10.2,0.10.3,0.10.3.1,and avoid the version (,0.10.4],0.5,0.5.1,0.5.2,0.6,0.6.1,0.7,0.7.1,0.8,0.8.1,0.8.2,0.8.3,0.8.4,0.9,0.9:b1,0.9:b2,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.10,0.10.1,0.10.2,0.10.3,0.10.3.1