Homepage
About Snyk

Open Redirect Affecting clearance package, versions <2.5.0

0.0
high

Snyk CVSS

    Attack Complexity Low
    User Interaction Required
    Availability High

    Threat Intelligence

    EPSS 0.06% (25th percentile)
Expand this section
NVD
6.1 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-CLEARANCE-1577284
  • published 31 Aug 2021
  • disclosed 31 Aug 2021
  • credit Snyk Security Team
Report a new vulnerability Found a mistake?

Introduced: 31 Aug 2021

CVE-2021-23435 Open this link in a new tab
CWE-601 Open this link in a new tab
First added by Snyk

How to fix?

Upgrade clearance to version 2.5.0 or higher.

Overview

clearance is an authentication app for rails.

Affected versions of this package are vulnerable to Open Redirect. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).

References