PT-2024-40491 · Cg · Cg

Published 2024-04-23 · Updated 2024-04-23

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions cg (affected versions not specified)

Description A vulnerability has been discovered in the handling of the referrer header in the application, which could allow an attacker to conduct open redirects. The issue arises from improper validation of the referrer header in certain conditions. By manipulating the referrer header, an attacker could potentially redirect users to malicious websites, phishing pages, or other dangerous destinations. This could lead to various attacks including phishing, malware distribution, or further exploitation of other vulnerabilities.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

GHSA-W228-RFPX-FHM4

Affected Products

Cg

References · 5

• https://osv.dev/vulnerability/GHSA-w228-rfpx-fhm4 · Vendor Advisory
• https://github.com/Clinical-Genomics/cg · Note
• https://github.com/Clinical-Genomics/cg/blob/master/cg/server/invoices/views.py#L173 · Note
• https://github.com/Clinical-Genomics/cg/security/advisories/GHSA-w228-rfpx-fhm4 · Note
• https://github.com/Clinical-Genomics/cg/commit/96e6a968a5a3639cc40ad251ad65952e4f38dd25 · Note