CVE-2020-4037

Source
https://nvd.nist.gov/vuln/detail/CVE-2020-4037
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-4037.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-4037
Aliases
Related
Published
2020-06-29T20:15:10Z
Modified
2025-01-15T01:45:43.835064Z
Severity
  • 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.

References

Affected packages

Git / github.com/oauth2-proxy/oauth2-proxy

Affected ranges

Type
GIT
Repo
https://github.com/oauth2-proxy/oauth2-proxy
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
Fixed

Affected versions

v0.*

v0.1

v1.*

v1.0
v1.1
v1.1.1

v2.*

v2.0
v2.0.1
v2.1
v2.2

v3.*

v3.0.0
v3.1.0
v3.2.0

v4.*

v4.0.0
v4.1.0

v5.*

v5.0.0
v5.1.0