A vulnerability has been discovered in Nokia Electronic Documentation (NED) that may allow an attacker to redirect connections to a third party system. The problem likely occurs due to the NED server failing to sufficiently verify hosts provided within specific HTTP requests. As a result, an attacker may be capable of making a request that would cause data to be redirected to a third party system.
This may allow an attacker to interact with an otherwise inaccessible system, or potentially hide the origin of attacks launched against other targets.
Nokia Electronic Documentation Connection Redirection
Nokia Electronic Documentation contains a flaw that allows a remote attacker to use the system as an open proxy. The issue is due to the NED utility allowing arbitrary web sites as valid arguments to the retrieve&location variable. Attackers using this may be able to gain access to additional internal web sites due to trust relationships.
Currently, there are no known upgrades, patches, or workarounds available to
correct this issue.