Open Redirect Affecting clearance package, versions <2.5.0
Threat Intelligence
EPSS
0.07% (31st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-CLEARANCE-1577284
- published 31 Aug 2021
- disclosed 31 Aug 2021
- credit Snyk Security Team
Introduced: 31 Aug 2021
CVE-2021-23435 Open this link in a new tabHow to fix?
Upgrade clearance to version 2.5.0 or higher.
Overview
clearance is an authentication app for rails.
Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).
References
CVSS Scores
version 3.1