CVE-2008-2951

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-07-27 · updated 2026-06-16
Weakness: CWE-601

Description

Open redirect vulnerability in the search script in Trac before 0.10.5 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the q parameter, possibly related to the quickjump function.

Affected products

Edgewall Trac: before 0.10.5 — fixed in 0.10.5
Fedoraproject Fedora: 8, 9

How to fix

Upgrade to a fixed version: Edgewall Trac 0.10.5. Check the vendor advisory for mitigations.

References

http://holisticinfosec.org/content/view/72/45/
http://secunia.com/advisories/31314
http://trac.edgewall.org/wiki/ChangeLog
http://www.osvdb.org/46513
http://www.securityfocus.com/bid/30402
https://exchange.xforce.ibmcloud.com/vulnerabilities/44043
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01261.html
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg01270.html
http://holisticinfosec.org/content/view/72/45/
http://secunia.com/advisories/31314
http://trac.edgewall.org/wiki/ChangeLog
http://www.osvdb.org/46513

Get alerted when CVE-2008-2951 or the next vulnerability affects your stack