PT-2021-19827 · Tenancy · Tenancy

Jazo · Published 2021-05-27 · Updated 2022-03-18 · CVE-2021-32645

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Tenancy multi-tenant versions prior to 5.7.2

Description The issue allows for open redirects, where users can be redirected from the site to any other site using a specially crafted URL. This occurs in installations using the default Hostname Identification and tenants with force https set to true.

Recommendations For versions prior to 5.7.2, update to version 5.7.2 to fix the bug. As a temporary workaround, consider setting the force https to false for every tenant, however, this may degrade connection security.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-32645

GHSA-4R8Q-GV9J-3XX6

Affected Products

Tenancy

References · 7

• https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164 · Patch
• https://osv.dev/vulnerability/CVE-2021-32645 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32645 · Security Note
• https://osv.dev/vulnerability/GHSA-4r8q-gv9j-3xx6 · Vendor Advisory
• https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6 · Note
• https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html · Note
• https://packagist.org/packages/hyn/multi-tenant · Note