Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-RUBY-CLEARANCE-1577284
- published 31 Aug 2021
- disclosed 31 Aug 2021
- credit Snyk Security Team
How to fix?
clearance to version 2.5.0 or higher.
clearance is an authentication app for rails.
Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of
session[:return_to]. If the value used for
return_to contains multiple leading slashes (
/////example.com) the user ends up being redirected to the external domain that comes after the slashes (