Homepage About Snyk

Open Redirect Affecting clearance package, versions <2.5.0

0.0
high

  • Attack Complexity

    Low

  • User Interaction

    Required

  • Availability

    High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

  • snyk-id

    SNYK-RUBY-CLEARANCE-1577284

  • published

    31 Aug 2021

  • disclosed

    31 Aug 2021

  • credit

    Snyk Security Team

Report a new vulnerability Found a mistake?

Introduced: 31 Aug 2021

CVE-2021-23435 Open this link in a new tab
CWE-601 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade clearance to version 2.5.0 or higher.

Overview

clearance is an authentication app for rails.

Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).

References