PT-2020-13193 · Macaron · Macaron

Ev0Ao

·

Published

2020-05-05

·

Updated

2022-10-28

·

CVE-2020-12666

CVSS v3.1

6.1

Medium

VectorAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions macaron versions prior to 1.3.7
Description The issue is related to an open redirect in the static handler due to improper request sanitization. This allows a specifically crafted URL to cause the static file handler to redirect to an attacker-chosen URL, enabling open redirect attacks. An example of such a URL is http://127.0.0.1:4000//example.com/.
Recommendations For versions prior to 1.3.7, update to version 1.3.7 or later to resolve the issue. As a temporary workaround, consider restricting access to the static handler to minimize the risk of exploitation. Avoid using crafted URLs that could trigger the open redirect until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-12666
GHSA-733F-44F3-3FRW
GO-2020-0039
RHSA-2020:3369

Affected Products

Macaron