GHSA-w228-rfpx-fhm4
- Source
- https://github.com/advisories/GHSA-w228-rfpx-fhm4
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-w228-rfpx-fhm4/GHSA-w228-rfpx-fhm4.json
- Published
- 2024-04-23T16:21:22Z
- Modified
- 2024-04-23T16:31:40.427906Z
- Details
-
Summary
A vulnerability has been discovered in the handling of the referrer header in the application, which could allow an attacker to conduct open redirects. The issue arises from improper validation of the referrer header in certain conditions. By manipulating the referrer header, an attacker could potentially redirect users to malicious websites, phishing pages, or other dangerous destinations.
PoC
If you change the referer header, you will be redirected to that domain without verifying.
https://github.com/Clinical-Genomics/cg/blob/master/cg/server/invoices/views.py#L173
Impact
An attacker exploiting this vulnerability could trick users into visiting malicious websites or disclose sensitive information by redirecting them to unintended destinations. This could lead to various attacks including phishing, malware distribution, or further exploitation of other vulnerabilities.
- References
Affected packages
PyPI / cg
Package
- Name
- cg
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0The exact introduced commit is unknownFixed60.2.12
Affected versions
0.*
0.9.0
0.9.1
1.*
1.0.0b2
1.0.0
12.*
12.1.3
12.1.4
12.1.5
12.1.6
12.1.7
12.2.0
12.3.0
12.3.1
12.3.2
12.3.3
12.3.4
12.3.5
12.3.6
12.4.0
12.5.0
12.6.0
12.7.0
12.7.1
13.*
13.0.0
13.1.0
13.2.0
13.3.0
13.3.1
13.4.0
13.4.1
13.5.0
13.6.0
13.7.0
13.8.0
13.9.0
13.10.0
13.10.1
13.11.0
13.12.0
13.12.1
13.13.0
13.14.0
13.14.1
13.14.2
13.14.3
13.15.0
13.16.0
13.16.1
13.16.2
13.17.0
13.17.1
13.17.2
13.18.0
14.*
14.0.0
14.0.1
15.*
15.0.0
15.0.1
15.0.2
15.0.3
15.0.4
16.*
16.0.0
16.0.1
16.0.2
16.0.3
16.0.4
16.0.5
16.0.6
16.1.0
16.1.1
16.2.0
16.3.0
16.3.1
16.3.2
16.3.3
16.3.4
16.4.0
16.4.1
16.4.2
16.4.3
16.5.0
16.6.0
16.7.0
16.7.1
16.8.0
16.8.1
16.9.0
16.10.0
16.10.1
16.10.2
16.10.3
16.10.4
16.11.0
16.11.1
16.12.0
16.12.1
16.13.0
16.14.0
16.15.0
16.15.1
16.16.0
16.16.1
16.17.0
16.17.1
17.*
17.0.0
17.1.0
17.2.0
17.2.1
18.*
18.0.0
18.1.0
18.1.1
18.1.2
18.1.3
18.1.4
18.1.5
18.2.0
18.3.0
18.4.0
18.5.0
18.5.1
18.6.0
18.7.0
18.7.1
18.7.2
18.8.0
18.9.0
18.9.1
18.10.0
18.10.1
18.10.2
18.11.0
18.11.1
18.11.2
18.11.3
18.11.4
18.12.0
18.12.1
19.*
19.0.0
19.1.0
19.1.1
19.2.0
19.3.0
19.3.1
19.3.2
19.4.0
19.5.0
19.5.1
19.5.2
19.5.3
19.5.4
20.*
20.0.0
20.0.1
20.1.0
20.1.1
20.1.2
20.1.3
20.1.4
20.2.0
20.2.1
20.3.0
20.3.1
20.3.2
20.3.3
20.4.0
20.5.0
20.5.1
20.5.2
20.5.3
20.5.4
20.6.0
20.7.0
20.8.0
20.8.1
20.9.0
20.9.1
20.9.2
20.9.3
20.9.5
20.9.6
20.9.7
20.9.8
20.9.9
20.9.10
20.9.11
20.9.12
20.10.0
20.10.1
20.11.0
20.12.0
20.12.1
20.13.0
20.14.0
20.14.1
20.14.2
20.15.0
20.15.1
20.16.0
20.17.0
20.17.1
20.17.2
20.17.3
20.17.4
20.17.5
20.18.0
20.19.0
20.19.1
20.19.2
20.19.3
20.19.4
20.19.5
20.20.0
20.20.1
20.21.0
20.21.1
20.22.0
20.23.0
20.24.0
20.25.0
20.26.0
20.26.1
20.26.2
21.*
21.0.0
21.1.0
21.2.0
21.3.0
21.3.1
21.4.0
21.4.1
21.4.2
21.4.3
21.4.4
21.5.0
21.5.1
21.5.2
21.5.3
21.5.4
21.5.5
21.5.6
21.5.7
21.6.0
21.6.1
21.6.2
21.6.3
21.6.4
21.6.5
21.6.6
21.6.7
21.6.8
21.6.9
21.7.0
21.7.1
21.7.2
21.8.0
21.8.1
21.8.2
21.8.3
21.9.0
21.9.1
21.9.2
21.9.3
21.10.0
21.11.0
21.12.0
21.12.1
21.12.2
21.13.0
22.*
22.0.0
22.0.1
22.1.0
22.1.1
22.1.2
22.1.3
22.2.0
22.2.1
22.2.2
22.3.0
22.3.1
22.4.0
22.4.1
22.5.0
22.5.1
22.5.2
22.6.0
22.6.1
22.7.0
22.8.0
22.8.1
22.8.2
22.8.3
22.8.4
22.8.5
22.8.6
22.9.0
22.9.1
22.9.2
22.9.3
22.9.4
22.10.0
22.10.1
22.10.2
22.10.3
22.11.1
22.11.2
22.12.0
22.13.0
22.14.0
22.15.0
22.16.0
22.17.0
22.17.1
22.17.2
22.18.0
22.19.0
22.19.1
22.19.2
22.19.3
22.19.4
22.19.5
22.19.6
22.19.7
22.19.8
22.20.0
22.20.1
22.21.0
22.21.1
22.22.0
22.23.0
22.23.1
22.23.2
22.24.0
22.24.1
22.25.1
22.25.2
22.25.3
22.25.4
22.25.5
22.25.6
22.26.0
22.27.0
22.28.0
22.29.0
22.29.1
22.29.2
22.29.3
22.30.0
22.31.0
22.31.1
22.31.2
22.31.3
22.31.4
22.31.5
22.31.6
22.31.7
22.32.0
22.32.1
22.32.2
22.33.0
22.34.0
22.34.1
22.34.2
22.34.3
22.34.4
22.35.0
22.36.0
22.36.1
22.37.0
22.37.2
22.37.3
22.37.4
22.38.0
22.38.1
22.38.2
22.38.3
22.39.0
22.39.1
22.40.1
22.40.2
22.40.3
22.40.4
22.40.5
22.41.0
22.41.1
22.41.2
22.41.3
22.42.0
22.43.0
22.43.1
22.43.2
22.44.0
22.44.1
22.44.2
22.44.3
22.44.4
22.44.5
22.45.0
22.46.0
22.46.1
22.46.2
22.46.3
22.46.4
22.46.5
22.46.6
22.47.0
22.47.1
22.48.0
22.48.1
22.49.0
22.49.1
22.49.2
22.50.0
22.51.0
22.52.0
22.53.0
22.54.0
22.54.1
22.54.2
22.54.3
22.54.4
22.54.5
22.54.6
22.54.7
22.54.9
22.54.10
22.54.11
22.54.12
22.55.0
22.55.1
22.56.0
22.56.1
22.56.2
22.56.3
22.57.0
22.57.2
22.57.3
22.57.4
22.57.5
22.58.0
22.59.0
22.60.0
22.61.0
22.61.1
22.61.2
22.61.3
22.61.4
22.61.5
22.62.0
22.62.2
22.62.3
22.63.0
22.63.1
22.63.2
22.63.3
22.64.0
22.65.0
22.65.1
22.66.0
22.67.0
22.67.1
22.68.0
22.69.0
22.70.0
22.70.1
22.71.0
22.71.1
22.72.0
22.73.0
22.74.0
22.74.1
22.75.0
22.75.1
22.75.2
22.75.3
22.75.4
22.75.5
22.76.0
22.76.1
22.77.1
22.77.2
22.78.0
22.78.1
22.78.2
22.78.3
22.78.4
22.78.5
22.78.6
22.78.7
22.78.8
22.78.9
22.79.0
22.79.1
22.80.0
22.80.1
22.81.0
22.81.1
22.81.2
22.81.3
22.81.4
22.81.5
22.82.0
22.83.0
22.83.1
22.84.0
22.84.1
22.84.2
22.84.3
22.84.4
22.84.5
22.84.6
22.85.0
22.85.1
22.85.2
22.85.3
22.85.4
22.85.5
22.85.6
22.86.0
22.87.0
22.88.0
22.89.0
22.89.1
22.89.2
22.90.0
22.90.1
22.90.2
22.90.3
22.91.0
23.*
23.0.0
23.1.0
23.1.1
23.2.0
23.2.2
23.2.3
23.2.4
23.2.5
23.2.6
23.3.0
23.3.1
23.3.3
23.3.4
23.3.5
23.3.6
23.4.0
23.5.0
23.6.0
23.6.1
23.6.2
23.6.3
23.6.4
23.7.0
23.7.1
23.7.2
23.7.3
23.8.0
23.8.1
23.8.2
24.*
24.0.0
24.0.1
24.0.2
24.0.3
24.0.5
24.0.6
24.0.7
24.0.8
24.0.9
24.1.0
24.1.1
25.*
25.0.0
25.1.0
25.2.0
25.2.1
25.2.2
25.3.0
26.*
26.0.0
26.0.1
26.0.2
26.0.3
26.0.4
26.0.5
26.0.6
26.0.7
26.0.8
26.0.9
26.1.0
26.1.1
26.1.2
26.2.0
26.2.1
26.3.0
26.3.1
26.3.2
26.3.3
26.3.4
26.3.5
26.4.0
26.4.1
26.4.2
26.4.3
26.5.0
26.5.1
26.6.0
26.6.1
26.6.2
26.6.3
26.7.0
26.7.1
26.7.2
26.7.3
26.7.4
26.7.5
27.*
27.0.0
27.0.1
27.0.2
27.0.3
27.0.4
27.0.5
27.0.6
27.0.7
27.0.8
27.0.10
27.0.11
27.1.1
27.1.2
27.1.3
27.1.4
27.1.5
27.1.6
27.1.7
27.1.8
27.1.9
27.1.10
27.1.11
27.1.12
27.1.13
27.1.14
27.1.15
27.1.16
27.1.17
27.1.18
27.1.19
27.1.20
27.1.21
27.1.22
27.1.23
27.1.24
27.1.25
27.1.26
27.1.28
27.1.29
27.1.30
27.1.31
27.1.32
27.1.33
27.1.34
27.1.35
27.1.36
27.1.37
27.1.38
27.1.39
27.1.40
27.1.41
27.1.42
27.1.43
27.1.44
27.1.45
27.1.46
27.1.47
27.1.48
27.1.49
27.1.50
27.1.51
27.1.52
27.1.53
27.1.55
27.1.56
27.1.57
27.1.58
27.1.59
27.1.60
27.1.61
27.1.62
27.1.64
27.2.0
27.2.1
27.2.2
27.2.3
27.2.4
27.2.5
27.2.6
27.2.7
27.2.8
27.2.9
27.2.10
27.2.11
27.2.12
27.2.13
27.2.14
27.2.15
27.3.0
27.3.1
27.3.2
27.3.3
27.3.4
27.3.5
27.3.7
27.3.8
27.3.9
27.3.10
27.3.11
27.3.12
27.3.13
28.*
28.0.0
28.0.1
28.0.2
28.0.3
28.0.4
28.0.5
29.*
29.0.0
29.0.1
29.0.2
29.0.3
29.1.0
29.1.1
29.1.2
29.1.3
29.1.4
29.1.5
29.1.6
29.1.7
29.2.0
29.3.0
29.3.1
29.4.0
29.4.1
29.4.2
29.4.3
29.4.4
29.4.5
29.4.6
29.4.7
29.4.8
29.4.9
29.4.10
29.4.11
29.4.12
29.4.13
29.5.0
29.5.1
29.5.2
29.5.3
29.5.4
29.5.5
29.5.6
29.5.7
29.6.0
29.7.0
29.7.1
29.8.0
29.8.1
29.8.2
29.8.3
29.8.4
29.8.5
29.8.6
29.8.7
30.*
30.0.0
30.1.0
30.1.1
30.1.2
30.1.4
30.2.0
30.2.2
30.2.3
30.2.4
30.2.6
30.2.7
30.3.0
31.*
31.0.0
31.0.1
31.0.2
31.1.0
31.1.2
31.1.3
31.1.4
31.1.5
31.1.6
31.2.0
31.2.1
31.2.2
31.2.3
32.*
32.0.0
32.1.0
32.2.0
32.2.1
32.2.2
32.2.3
32.2.4
32.2.5
32.2.7
32.2.8
33.*
33.0.0
33.0.1
33.0.2
33.0.3
33.0.4
33.0.5
33.0.6
33.1.0
33.1.1
33.1.2
33.1.3
33.1.4
33.1.5
33.1.6
33.2.0
33.2.1
33.2.3
33.3.0
33.3.1
33.3.2
33.3.3
33.3.4
34.*
34.0.0
35.*
35.0.1
35.0.2
36.*
36.0.1
36.0.2
36.0.3
36.0.4
36.1.0
36.2.1
36.2.2
36.2.3
36.2.4
36.2.5
36.2.6
36.2.7
36.3.0
36.3.1
36.3.2
36.4.0
36.4.1
36.4.2
36.5.0
36.5.1
37.*
37.0.0
37.0.1
37.0.2
37.0.3
37.0.4
37.0.5
37.0.6
37.0.7
37.0.8
37.0.9
37.0.10
37.0.11
37.0.12
37.0.13
37.0.14
37.0.15
37.0.16
37.0.17
37.0.20
37.0.21
37.0.22
37.0.23
37.0.24
37.0.25
37.0.26
37.0.28
37.1.0
37.2.0
38.*
38.0.0
38.0.1
38.0.2
38.1.0
38.1.1
38.1.2
38.1.3
38.1.4
38.1.5
38.1.6
38.1.7
38.1.8
38.1.9
38.2.0
38.2.1
38.2.2
38.2.3
38.2.4
38.2.5
38.2.6
38.2.7
38.2.8
38.2.9
38.2.10
38.3.0
38.3.1
38.3.2
38.3.3
38.3.4
38.3.5
39.*
39.0.0
39.1.0
40.*
40.0.0
40.0.1
40.1.0
40.1.1
40.1.2
40.1.3
40.1.4
40.1.5
40.2.0
40.2.1
40.2.2
40.2.3
40.3.0
40.3.1
40.3.2
40.3.3
40.4.0
40.4.1
40.5.0
40.5.1
40.6.0
40.6.1
40.6.2
40.6.3
40.7.0
40.7.1
40.8.1
40.8.2
40.9.1
40.9.2
40.9.4
40.9.5
40.9.6
40.9.7
40.10.0
40.10.1
40.11.0
40.11.1
40.12.0
40.12.1
40.12.2
40.12.3
40.12.4
41.*
41.0.0
41.0.1
41.0.2
42.*
42.0.0
43.*
43.0.0
43.0.1
43.0.2
43.0.3
43.0.4
43.0.5
44.*
44.0.0
44.0.1
44.0.2
44.0.3
44.0.4
44.0.5
45.*
45.0.0
45.0.1
45.0.2
45.0.3
45.0.4
45.0.5
45.0.6
45.0.7
45.0.8
45.0.9
45.0.10
45.0.11
45.0.12
45.0.13
45.0.14
45.0.15
45.0.16
45.0.17
45.1.0
45.1.1
45.1.2
45.1.3
45.2.0
45.2.1
45.2.2
45.3.0
45.4.0
45.4.1
45.4.2
45.4.3
45.4.4
45.4.5
45.5.0
45.5.1
45.5.2
45.5.3
45.5.4
45.5.5
46.*
46.0.0
46.0.1
46.0.2
46.0.3
46.0.4
46.0.5
47.*
47.0.0
47.0.1
48.*
48.0.0
49.*
49.0.0
49.0.1
49.0.2
49.0.3
49.0.4
49.0.5
49.0.6
49.0.7
49.0.8
49.0.9
49.0.10
49.0.11
49.0.12
49.0.13
49.0.14
49.0.16
49.1.0
49.2.0
49.3.0
49.4.0
49.4.1
49.4.2
49.4.3
49.4.4
49.4.5
49.4.6
49.4.7
49.5.0
49.5.1
49.5.2
50.*
50.0.0
50.1.0
50.1.1
50.1.2
50.1.3
50.1.4
50.1.5
50.1.6
50.1.7
50.1.8
50.1.9
50.1.10
51.*
51.0.0
51.0.1
51.0.2
51.0.3
51.0.4
51.0.5
51.0.6
51.0.7
51.0.8
51.0.9
51.1.0
51.1.1
51.1.2
51.1.3
51.2.0
51.2.1
51.2.2
51.2.3
51.2.4
51.2.5
51.2.6
51.2.7
51.2.8
51.2.9
51.3.0
51.3.1
51.4.0
51.4.1
51.5.1
51.5.2
51.5.3
51.5.4
51.5.5
51.5.6
51.5.7
51.5.8
51.5.9
51.5.10
51.5.11
51.5.12
51.5.13
51.5.14
51.5.15
51.6.0
51.6.1
51.6.2
51.6.3
51.6.4
51.6.5
51.6.6
51.6.7
51.6.8
51.6.9
51.6.10
51.6.11
51.6.12
51.6.13
51.6.14
51.7.0
51.7.1
51.7.2
51.7.3
51.7.4
51.7.5
51.7.6
51.8.0
51.8.1
51.9.0
51.9.1
51.9.2
51.9.3
51.9.4
51.9.5
51.9.6
51.9.7
51.9.8
51.9.10
51.10.0
51.10.1
51.10.2
51.10.3
51.10.4
51.10.5
51.10.6
51.10.7
52.*
52.0.0
52.0.1
52.0.2
52.0.3
52.0.4
52.0.5
52.0.6
52.0.7
52.0.8
52.0.9
52.0.10
52.0.11
52.1.0
52.1.1
52.1.2
52.1.3
52.1.4
52.1.5
52.1.6
53.*
53.0.0
53.0.1
53.0.2
53.1.0
53.1.1
53.1.2
53.1.3
53.1.4
53.1.5
53.1.6
53.1.7
53.1.8
53.1.9
53.1.10
53.1.11
53.2.0
53.3.0
53.4.0
53.4.1
53.4.2
53.4.3
53.4.4
53.4.5
53.4.6
53.4.7
53.4.8
53.5.0
53.5.1
53.5.2
53.5.3
53.5.4
53.6.0
54.*
54.0.0
54.1.0
54.1.1
54.1.2
54.1.3
54.2.0
54.2.1
54.3.0
54.3.1
54.4.0
54.4.1
54.4.2
54.4.3
54.4.4
54.4.5
54.4.6
54.4.7
54.4.8
54.4.9
54.4.10
54.5.0
54.5.1
54.5.2
54.5.3
54.6.0
54.6.1
54.7.0
54.9.0
54.9.1
54.10.0
54.10.1
54.10.2
54.10.3
54.10.4
54.10.5
54.10.6
54.10.7
55.*
55.0.0
55.1.0
55.1.1
55.2.0
55.2.1
55.2.2
55.2.3
55.3.0
55.3.1
55.3.2
55.3.3
55.3.4
55.3.5
55.3.6
55.3.7
55.3.8
55.3.9
55.3.10
55.4.0
55.4.1
55.4.2
55.4.3
55.4.4
55.4.5
55.4.6
55.4.7
55.4.8
55.4.9
55.4.10
55.4.11
55.5.0
55.6.0
55.6.1
55.6.2
56.*
56.0.0
56.0.1
56.0.2
56.1.0
56.2.0
56.2.1
56.2.2
56.2.3
56.2.4
56.2.5
56.2.6
56.2.7
56.2.8
56.3.0
56.3.1
56.3.2
56.3.3
56.3.4
56.3.5
56.3.6
56.3.7
56.3.8
56.3.9
57.*
57.0.0
57.0.1
57.0.2
57.0.3
57.0.4
57.0.5
57.0.6
57.0.7
58.*
58.0.0
58.1.0
58.1.1
58.1.2
58.1.3
58.1.4
58.1.5
58.1.6
58.1.7
58.1.8
58.1.9
59.*
59.0.0
59.1.0
59.1.1
59.2.0
59.2.1
59.3.0
59.3.1
59.4.0
59.4.1
59.4.2
59.4.3
59.4.4
59.4.5
59.4.6
59.4.7
59.5.0
59.5.1
59.5.2
59.5.3
59.5.4
59.5.6
59.5.7
59.5.8
59.5.9
59.6.0
59.6.1
59.6.2
59.6.3
59.7.0
59.7.1
59.7.2
59.7.3
59.8.0
59.9.0
59.9.1
59.10.0
59.10.1
59.10.2
59.10.3
59.10.4
59.10.5
59.10.6
59.10.7
59.10.8
59.11.0
59.11.1
59.11.2
59.12.0
59.14.0
59.14.1
59.14.2
59.14.3
59.14.4
59.14.5
59.14.6
59.14.7
59.14.8
59.14.9
59.14.10
59.14.11
59.14.12
59.14.13
59.15.0
59.15.1
59.15.2
59.15.3
59.15.4
59.15.5
59.16.0
59.17.0
59.17.1
59.17.2
59.17.3
59.18.0
59.20.1
59.20.2
59.20.3
59.20.4
59.20.5
59.20.6
59.20.7
59.21.0
59.22.0
59.22.1
59.22.2
59.22.3
59.22.4
59.22.5
59.22.6
59.22.7
59.23.0
59.24.0
59.24.1
59.24.2
59.25.0
59.25.1
59.25.2
59.25.3
59.25.4
59.25.5
59.25.6
59.25.7
59.25.8
60.*
60.0.0
60.1.0
60.1.1
60.1.2
60.1.3
60.1.4
60.1.5
60.1.6
60.2.0
60.2.1
60.2.2
60.2.3
60.2.4
60.2.5
60.2.6
60.2.8
60.2.9
60.2.10