PT-2020-14307 · Vercel · Next.Js

Timneutkens · Published 2020-10-08 · Updated 2020-12-03 · CVE-2020-15242

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Next.js versions 9.5.0 through 9.5.3

Description The issue allows for an Open Redirect, where specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. This redirect does not directly harm users, although it can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain.

Recommendations For Next.js versions 9.5.0 through 9.5.3, upgrade to version 9.5.4 to resolve the issue. As a temporary workaround, consider restricting access to specially encoded paths to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2020-15242

GHSA-X56P-C8CG-Q435

Affected Products

Next.Js

References · 7

• https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-15242 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15242 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x56p-c8cg-q435 · Vendor Advisory
• https://github.com/vercel/next.js · Note
• https://github.com/zeit/next.js/releases/tag/v9.5.4 · Note
• https://t.me/cibsecurity/15168 · Telegram Post