GitHub Advisoryadvisory · Go

GHSA-733f-44f3-3frw gopkg.in/macaron.v1 Open Redirect vulnerability

MEDIUM Published 2021-05-18 Modified 2024-05-20 Official page ↗
Aliases
CVE-2020-12666
Ecosystem
Go
Packages
gopkg.in/macaron.v1
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-05-18

Affected packages

• Go gopkg.in/macaron.v1: < 1.3.7 → fixed in 1.3.7

Description

macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.

Related

Alias · CVE (1)

  • CVE-2020-12666 macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References