CWE-601
AllowedURL Redirection to Untrusted Site ('Open Redirect')
Abstraction: Base · Status: Draft
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
2305 vulnerabilities reference this CWE, most recent first.
GHSA-V735-HRPQ-C278
Vulnerability from github – Published: 2024-08-20 15:32 – Updated: 2024-08-20 15:32A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user's browser session.
{
"affected": [],
"aliases": [
"CVE-2024-6377"
],
"database_specific": {
"cwe_ids": [
"CWE-601",
"CWE-79"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-20T14:15:09Z",
"severity": "HIGH"
},
"details": "A reflected Cross-site Scripting (XSS) vulnerability affecting 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2024x allows an attacker to execute arbitrary script code in user\u0027s browser session.",
"id": "GHSA-v735-hrpq-c278",
"modified": "2024-08-20T15:32:13Z",
"published": "2024-08-20T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6377"
},
{
"type": "WEB",
"url": "https://www.3ds.com/vulnerability/advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V78W-VPXH-P52W
Vulnerability from github – Published: 2025-07-31 15:35 – Updated: 2025-07-31 21:31An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.
{
"affected": [],
"aliases": [
"CVE-2024-34328"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-31T15:15:35Z",
"severity": "MODERATE"
},
"details": "An open redirect in Sielox AnyWare v2.1.2 allows attackers to execute a man-in-the-middle attack via a crafted URL.",
"id": "GHSA-v78w-vpxh-p52w",
"modified": "2025-07-31T21:31:49Z",
"published": "2025-07-31T15:35:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34328"
},
{
"type": "WEB",
"url": "https://github.com/0xsu3ks/CVE-2024-34328"
},
{
"type": "WEB",
"url": "https://sielox.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-V865-WGVP-J2Q9
Vulnerability from github – Published: 2022-05-24 17:35 – Updated: 2022-05-24 17:35SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.
{
"affected": [],
"aliases": [
"CVE-2020-26836"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-09T17:15:00Z",
"severity": "MODERATE"
},
"details": "SAP Solution Manager (Trace Analysis), version - 720, allows for misuse of a parameter in the application URL leading to Open Redirect vulnerability, an attacker can enter a link to malicious site which could trick the user to enter credentials or download malicious software, as a parameter in the application URL and share it with the end user who could potentially become a victim of the attack.",
"id": "GHSA-v865-wgvp-j2q9",
"modified": "2022-05-24T17:35:35Z",
"published": "2022-05-24T17:35:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26836"
},
{
"type": "WEB",
"url": "https://launchpad.support.sap.com/#/notes/2938650"
},
{
"type": "WEB",
"url": "https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=564757079"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/163136/SAP-Solution-Manager-7.2-ST-720-Open-Redirection.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2021/Jun/25"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-V867-C875-J3HH
Vulnerability from github – Published: 2023-07-20 21:30 – Updated: 2024-04-04 06:18SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.
{
"affected": [],
"aliases": [
"CVE-2021-39425"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-20T20:15:10Z",
"severity": "MODERATE"
},
"details": "SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. An attacker may exploit this vulnerability to redirect users to arbitrary web URLs by tricking the victim users to click on crafted links.",
"id": "GHSA-v867-c875-j3hh",
"modified": "2024-04-04T06:18:09Z",
"published": "2023-07-20T21:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39425"
},
{
"type": "WEB",
"url": "https://medium.com/%40rohitgautam26/cve-2021-39425-8a336eba34dd"
},
{
"type": "WEB",
"url": "https://medium.com/@rohitgautam26/cve-2021-39425-8a336eba34dd"
},
{
"type": "WEB",
"url": "https://owasp.org/www-project-web-security-testing-guide/v41/4-Web_Application_Security_Testing/11-Client_Side_Testing/04-Testing_for_Client_Side_URL_Redirect"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V875-G963-FHG4
Vulnerability from github – Published: 2022-05-24 17:02 – Updated: 2024-04-04 02:42inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
{
"affected": [],
"aliases": [
"CVE-2016-1000107"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-10T18:15:00Z",
"severity": "MODERATE"
},
"details": "inets in Erlang possibly 22.1 and earlier follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application\u0027s outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an \"httpoxy\" issue.",
"id": "GHSA-v875-g963-fhg4",
"modified": "2024-04-04T02:42:27Z",
"published": "2022-05-24T17:02:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1000107"
},
{
"type": "WEB",
"url": "https://bugs.erlang.org/browse/ERL-198"
},
{
"type": "WEB",
"url": "https://httpoxy.org"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2016-1000107"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/07/18/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-V8HP-239V-9367
Vulnerability from github – Published: 2024-05-20 14:19 – Updated: 2024-05-20 14:19OroCRM is prone to open redirection which could allow attackers to redirect users to external website.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "oro/crm"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2024-05-20T14:19:27Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "OroCRM is prone to open redirection which could allow attackers to redirect users to external website.",
"id": "GHSA-v8hp-239v-9367",
"modified": "2024-05-20T14:19:27Z",
"published": "2024-05-20T14:19:27Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/oroinc/crm/commit/f86a959dcd77af09e7a5a5930a60cf409924a2be"
},
{
"type": "WEB",
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/oro/crm/2015-07-08.yaml"
},
{
"type": "PACKAGE",
"url": "https://github.com/oroinc/crm"
},
{
"type": "WEB",
"url": "https://oroinc.com/orocrm/blog/orocrm-security-announcement"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "OroCRM Forced Redirect to External Website"
}
GHSA-V8MC-9377-RWJJ
Vulnerability from github – Published: 2023-07-06 19:47 – Updated: 2023-07-06 19:47Impact
During file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest's host.
This vulnerable behavior is present in all versions of youtube-dl, youtube-dlc and yt-dlp released since 2015.01.25. All native and external downloaders are affected, except for curl and httpie (httpie version 3.1.0 or later).
At the file download stage, all cookies are passed by yt-dlp to the file downloader as a Cookie header, thereby losing their scope. This also occurs in yt-dlp's info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.
An example of a potential attack scenario exploiting this vulnerability:
1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an unvalidated redirect to a target URL.
2. yt-dlp extracts this URL and calculates a Cookie header based on its domain for the file downloader to make its request(s) with.
3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user's sensitive cookie information.
Patches
yt-dlp version 2023.07.06 fixes this issue by doing the following:
- Remove the
Cookieheader upon HTTP redirects - Have native downloaders calculate their own
Cookieheader from the cookiejar - Utilize external downloaders' built-in support for cookies instead of passing them as header arguments
- If the external downloader does not have proper cookie support, then disable HTTP redirection (
axelonly) - Process cookies passed as HTTP headers to limit their scope (
--add-header "Cookie:..."is scoped to input URL domain only) - Store cookies in a separate
cookiesfield of the info dict instead ofhttp_headersso as not to lose their scope
Patches for youtube-dl are expected and we will update this advisory when they are merged.
Workarounds
It is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible.
For users who are not able to upgrade:
- Avoid using cookies and user authentication methods (
--cookies,--cookies-from-browser,--username,--password,--netrc). While extractors may set custom cookies, these usually do not contain sensitive information. - Avoid using
--load-info-json
Or, if authentication is a must:
- Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp
- Use
curlas external downloader, since it is not impacted (--downloader curl) - Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use
-f "(bv*+ba/b)[protocol~='^https?$']")
References
- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj
- https://nvd.nist.gov/vuln/detail/CVE-2023-35934
- https://github.com/yt-dlp/yt-dlp/releases/tag/2023.07.06
- https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519
- https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729
- https://github.com/yt-dlp/yt-dlp/commit/f8b4bcc0a791274223723488bfbfc23ea3276641
- https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "yt-dlp"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2023.7.06"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-35934"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-06T19:47:40Z",
"nvd_published_at": "2023-07-06T20:15:09Z",
"severity": "MODERATE"
},
"details": "### Impact\nDuring file downloads, yt-dlp or the external downloaders that yt-dlp employs may leak cookies on HTTP redirects to a different host, or leak them when the host for download fragments differs from their parent manifest\u0027s host.\n\nThis vulnerable behavior is present in all versions of [youtube-dl](https://github.com/ytdl-org/youtube-dl), [youtube-dlc](https://github.com/blackjack4494/yt-dlc) and [yt-dlp](https://github.com/yt-dlp/yt-dlp) released since 2015.01.25. All native and external downloaders are affected, except for `curl` and `httpie` (httpie version 3.1.0 or later).\n\nAt the file download stage, all cookies are passed by yt-dlp to the file downloader as a `Cookie` header, thereby losing their scope. This also occurs in yt-dlp\u0027s info JSON output, which may be used by external tools. As a result, the downloader or external tool may indiscriminately send cookies with requests to domains or paths for which the cookies are not scoped.\n\nAn example of a potential attack scenario exploiting this vulnerability:\n1. an attacker has crafted a malicious website with an embedded URL designed to be detected by yt-dlp as a video download. This embedded URL has the domain of a trusted site that the user has loaded cookies for, and conducts an [unvalidated redirect](https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html) to a target URL.\n2. yt-dlp extracts this URL and calculates a `Cookie` header based on its domain for the file downloader to make its request(s) with.\n3. the download URL redirects to a server controlled by the attacker, to which yt-dlp forwards the user\u0027s sensitive cookie information.\n\n### Patches\nyt-dlp version 2023.07.06 fixes this issue by doing the following:\n\n- Remove the `Cookie` header upon HTTP redirects\n- Have native downloaders calculate their own `Cookie` header from the cookiejar\n- Utilize external downloaders\u0027 built-in support for cookies instead of passing them as header arguments\n- If the external downloader does not have proper cookie support, then disable HTTP redirection (`axel` only)\n- Process cookies passed as HTTP headers to limit their scope (`--add-header \"Cookie:...\"` is scoped to input URL domain only)\n- Store cookies in a separate `cookies` field of the info dict instead of `http_headers` so as not to lose their scope\n\nPatches for youtube-dl are expected and we will update this advisory when they are merged.\n\n### Workarounds\nIt is recommended to upgrade yt-dlp to version 2023.07.06 as soon as possible.\n\nFor users who are not able to upgrade:\n\n - Avoid using cookies and user authentication methods (`--cookies`, `--cookies-from-browser`, `--username`, `--password`, `--netrc`). While extractors may set custom cookies, these usually do not contain sensitive information.\n - Avoid using `--load-info-json`\n\nOr, if authentication is a must:\n\n- Verify the integrity of download links from unknown sources in browser (including redirects) before passing them to yt-dlp\n- Use `curl` as external downloader, since it is not impacted (`--downloader curl`)\n- Avoid fragmented formats such as HLS/m3u8, DASH/mpd and ISM (use `-f \"(bv*+ba/b)[protocol~=\u0027^https?$\u0027]\"`)\n\n### References\n- https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj\n- https://nvd.nist.gov/vuln/detail/CVE-2023-35934\n- https://github.com/yt-dlp/yt-dlp/releases/tag/2023.07.06\n- https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519\n- https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729\n- https://github.com/yt-dlp/yt-dlp/commit/f8b4bcc0a791274223723488bfbfc23ea3276641\n- https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07",
"id": "GHSA-v8mc-9377-rwjj",
"modified": "2023-07-06T19:47:40Z",
"published": "2023-07-06T19:47:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-v8mc-9377-rwjj"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35934"
},
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp/commit/1ceb657bdd254ad961489e5060f2ccc7d556b729"
},
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp/commit/3121512228487c9c690d3d39bfd2579addf96e07"
},
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp/commit/f8b4bcc0a791274223723488bfbfc23ea3276641"
},
{
"type": "PACKAGE",
"url": "https://github.com/yt-dlp/yt-dlp"
},
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp-nightly-builds/releases/tag/2023.07.06.185519"
},
{
"type": "WEB",
"url": "https://github.com/yt-dlp/yt-dlp/releases/tag/2023.07.06"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5X6YT6AQE5FHM5VTQLKKJXSYBLLJF26W"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HEOKCGVONGHR2SYUIXU33A4MKXZBDP6L"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IM44RJL2MR2WG3ZY354C5IUEEZUJGEVA"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M7E7CQ5S5KMZHAMCNU7V7KYNBVCPLBHG"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "yt-dlp File Downloader cookie leak"
}
GHSA-V8VW-GW5J-W7M6
Vulnerability from github – Published: 2026-05-08 17:02 – Updated: 2026-05-15 23:47Summary
The TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com — which browsers interpret as an absolute URL to an external domain.
Details
The TrailingSlashMiddleware strips trailing slashes from request paths and issues a 308 Permanent Redirect to the cleaned path. However, it does not validate or sanitize the resulting path before using it as the redirect target.
When a request is made with a path like //evil.com/, the middleware processes it as follows:
PoC
- Start the registry server locally or identify a deployed instance
- Send a request with a double-slash path followed by an external domain:
curl -v https://<registry-host>//evil.com/ - Observe the 308 Permanent Redirect response with Location: //evil.com:
- When accessed in a browser, the user is redirected to https://evil.com
Impact
Phishing: Attackers can abuse the trusted registry domain to redirect users to credential-harvesting pages Malware distribution: Redirect users to sites serving malicious downloads Trust abuse: Links originating from the official MCP Registry domain carry implicit trust
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/modelcontextprotocol/registry"
},
"ranges": [
{
"events": [
{
"introduced": "1.1.0"
},
{
"fixed": "1.7.5"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44427"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T17:02:12Z",
"nvd_published_at": "2026-05-14T22:16:44Z",
"severity": "MODERATE"
},
"details": "### Summary\nThe TrailingSlashMiddleware in internal/api/server.go is vulnerable to an open redirect attack. An attacker can craft a URL with a protocol-relative path (e.g., //evil.com/) that, after trailing slash removal, results in a Location header of //evil.com \u2014 which browsers interpret as an absolute URL to an external domain.\n\n### Details\nThe TrailingSlashMiddleware strips trailing slashes from request paths and issues a 308 Permanent Redirect to the cleaned path. However, it does not validate or sanitize the resulting path before using it as the redirect target.\n\nWhen a request is made with a path like //evil.com/, the middleware processes it as follows:\n\n### PoC\n1. Start the registry server locally or identify a deployed instance\n2. Send a request with a double-slash path followed by an external domain:\n`curl -v https://\u003cregistry-host\u003e//evil.com/`\n\u003cimg width=\"3066\" height=\"969\" alt=\"image\" src=\"https://github.com/user-attachments/assets/a5305f00-29bf-4708-952a-478d608f2074\" /\u003e\n3. Observe the 308 Permanent Redirect response with Location: //evil.com:\n4. When accessed in a browser, the user is redirected to https://evil.com\n\n\n\n### Impact\n**Phishing**: Attackers can abuse the trusted registry domain to redirect users to credential-harvesting pages\n**Malware distribution**: Redirect users to sites serving malicious downloads\n**Trust abuse:** Links originating from the official MCP Registry domain carry implicit trust",
"id": "GHSA-v8vw-gw5j-w7m6",
"modified": "2026-05-15T23:47:07Z",
"published": "2026-05-08T17:02:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/security/advisories/GHSA-v8vw-gw5j-w7m6"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44427"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/pull/1227"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/commit/1201cbd82b2cf6d4b56edfc05c763059a12f9fdb"
},
{
"type": "PACKAGE",
"url": "https://github.com/modelcontextprotocol/registry"
},
{
"type": "WEB",
"url": "https://github.com/modelcontextprotocol/registry/releases/tag/v1.7.5"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "MCP Registry has open redirect via protocol-relative path in trailing-slash middleware"
}
GHSA-V936-J8GP-9Q3P
Vulnerability from github – Published: 2021-02-26 17:28 – Updated: 2024-09-24 15:35Impact
Requests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.
For the most thorough protection server administrators should remove the deprecated federation_ip_range_blacklist from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new ip_range_blacklist and ip_range_whitelist settings if more specific control is necessary.
Patches
Issue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954.
Workarounds
Requests to internal IP addresses could be blocked at the system or network level.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "matrix-synapse"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.25.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-21273"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2021-02-26T17:26:48Z",
"nvd_published_at": "2021-02-26T18:15:00Z",
"severity": "MODERATE"
},
"details": "### Impact\nRequests to user provided domains were not restricted to external IP addresses when calculating the key validity for third-party invite events and sending push notifications. This could cause Synapse to make requests to internal infrastructure. The type of request was not controlled by the user, although limited modification of request bodies was possible.\n\nFor the most thorough protection server administrators should remove the deprecated `federation_ip_range_blacklist` from their settings after upgrading to Synapse v1.25.0 which will result in Synapse using the improved default IP address restrictions. See the new `ip_range_blacklist` and `ip_range_whitelist` settings if more specific control is necessary.\n\n### Patches\nIssue is resolved by #8821. Further improvements to protect homeservers by default were made in #8870 and #8954.\n\n### Workarounds\nRequests to internal IP addresses could be blocked at the system or network level.",
"id": "GHSA-v936-j8gp-9q3p",
"modified": "2024-09-24T15:35:29Z",
"published": "2021-02-26T17:28:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/security/advisories/GHSA-v936-j8gp-9q3p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21273"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/pull/8821"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/commit/30fba6210834a4ecd91badf0c8f3eb278b72e746"
},
{
"type": "PACKAGE",
"url": "https://github.com/matrix-org/synapse"
},
{
"type": "WEB",
"url": "https://github.com/matrix-org/synapse/releases/tag/v1.25.0"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2021-131.yaml"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TNNAJOZNMVMXM6AS7RFFKB4QLUJ4IFEY"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Open redirects on some federation and push requests"
}
GHSA-V93C-CXJ5-C398
Vulnerability from github – Published: 2022-12-12 09:30 – Updated: 2022-12-12 22:19Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Google Login Plugin 1.7 only redirects to relative (Jenkins) URLs.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:google-login"
},
"ranges": [
{
"events": [
{
"introduced": "1.4"
},
{
"fixed": "1.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-46683"
],
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-12T22:19:23Z",
"nvd_published_at": "2022-12-12T09:15:00Z",
"severity": "MODERATE"
},
"details": "Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. Google Login Plugin 1.7 only redirects to relative (Jenkins) URLs.\n\n",
"id": "GHSA-v93c-cxj5-c398",
"modified": "2022-12-12T22:19:23Z",
"published": "2022-12-12T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46683"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/google-login-plugin/commit/532d714943ff8ae8dc862427d39a4b78b7f6a375"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/google-login-plugin"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2022-12-07/#SECURITY-2967"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Google Login Plugin Open Redirect vulnerability"
}
Mitigation MIT-5
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Use a list of approved URLs or domains to be used for redirection.
Mitigation
Use an intermediate disclaimer page that provides the user with a clear warning that they are leaving the current site. Implement a long timeout before the redirect occurs, or force the user to click on the link. Be careful to avoid XSS problems (CWE-79) when generating the disclaimer page.
Mitigation MIT-21.2
Strategy: Enforcement by Conversion
- When the set of acceptable objects, such as filenames or URLs, is limited or known, create a mapping from a set of fixed input values (such as numeric IDs) to the actual filenames or URLs, and reject all other inputs.
- For example, ID 1 could map to "/login.asp" and ID 2 could map to "http://www.example.com/". Features such as the ESAPI AccessReferenceMap [REF-45] provide this capability.
Mitigation
Ensure that no externally-supplied requests are honored by requiring that all redirect requests include a unique nonce generated by the application [REF-483]. Be sure that the nonce is not predictable (CWE-330).
Mitigation MIT-6
Strategy: Attack Surface Reduction
- Understand all the potential areas where untrusted inputs can enter your software: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any external systems that provide data to the application. Remember that such inputs may be obtained indirectly through API calls.
- Many open redirect problems occur because the programmer assumed that certain inputs could not be modified, such as cookies and hidden form fields.
Mitigation MIT-29
Strategy: Firewall
Use an application firewall that can detect attacks against this weakness. It can be beneficial in cases in which the code cannot be fixed (because it is controlled by a third party), as an emergency prevention measure while more comprehensive software assurance measures are applied, or to provide defense in depth [REF-1481].
CAPEC-178: Cross-Site Flashing
An attacker is able to trick the victim into executing a Flash document that passes commands or calls to a Flash player browser plugin, allowing the attacker to exploit native Flash functionality in the client browser. This attack pattern occurs where an attacker can provide a crafted link to a Flash document (SWF file) which, when followed, will cause additional malicious instructions to be executed. The attacker does not need to serve or control the Flash document. The attack takes advantage of the fact that Flash files can reference external URLs. If variables that serve as URLs that the Flash application references can be controlled through parameters, then by creating a link that includes values for those parameters, an attacker can cause arbitrary content to be referenced and possibly executed by the targeted Flash application.