GitHub Advisoryadvisory · Go

GHSA-5m6c-jp6f-2vcv Open Redirect in OAuth2 Proxy

MEDIUM Published 2021-12-20 Modified 2021-05-24 Official page ↗
Aliases
CVE-2020-4037
Ecosystem
Go
Packages
github.com/oauth2-proxy/oauth2-proxy
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Weaknesses
CWE-601
Reviewed
2021-05-24

Affected packages

• Go github.com/oauth2-proxy/oauth2-proxy: >= 5.1.1, < 6.0.0 → fixed in 6.0.0

Description

Impact As users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites.

Related

Alias · CVE (1)

  • CVE-2020-4037 In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References