GitHub Advisoryadvisory · PyPI

GHSA-5p9j-w2wx-qx4c Open Redirect in django-spirit

MEDIUM Published 2022-03-07 Modified 2022-03-14 Official page ↗
Aliases
CVE-2022-0869
Ecosystem
PyPI
Packages
django-spirit
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2022-03-07

Affected packages

• PyPI django-spirit: < 0.12.3 → fixed in 0.12.3

Description

django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.

Related

Alias · CVE (1)

  • CVE-2022-0869 Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References