PT-2022-9402 · Karma · Karma

Unknown · Published 2022-02-25 · Updated 2022-03-08 · CVE-2021-23495

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions karma versions prior to 6.3.16

Description The issue is related to an Open Redirect vulnerability due to missing validation of the return url query parameter. This allows for potential redirection to unintended locations.

Recommendations For versions prior to 6.3.16, update to version 6.3.16 or later to resolve the issue. As a temporary workaround, consider validating the return url query parameter to ensure it points to an intended location within the application. Restrict access to the return url parameter in the affected API endpoint to minimize the risk of exploitation.

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2021-23495

GHSA-RC3X-JF5G-XVC5

SNYK-JAVA-ORGWEBJARSNPM-2412347

SNYK-JS-KARMA-2396325

Affected Products

Karma

References · 9

• https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d · Patch
• https://osv.dev/vulnerability/CVE-2021-23495 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23495 · Security Note
• https://snyk.io/vuln/SNYK-JS-KARMA-2396325 · Patch
• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347 · Patch
• https://osv.dev/vulnerability/GHSA-rc3x-jf5g-xvc5 · Vendor Advisory
• https://github.com/karma-runner/karma · Note
• https://t.me/cvenotify/27406 · Telegram Post
• https://t.me/cvenotify/27892 · Telegram Post