GitHub Advisoryadvisory · Packagist

GHSA-4r8q-gv9j-3xx6 Open Redirect

MEDIUM Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2021-32645
Ecosystem
Packagist
Packages
hyn/multi-tenant
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-05-27

Affected packages

• Packagist hyn/multi-tenant: >= 5.6.0, < 5.7.2 → fixed in 5.7.2

Description

Impact In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`) Patches Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. Workarounds There is a simple way to work around the security issue • Set the `force_https` to every tenant to `false` References https://nvd.nist.gov/vuln/detail/CVE-2018-11784 For more information If you have any questions or comments about this advisory: • Contact us in Discord: https://tenancy.dev/chat

Related

Alias · CVE (1)

  • CVE-2021-32645 Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References