CVE-2020-4037CWE-601

Open Redirect in OAuth2 Proxy

Medium · published June 29, 2020

CVSS v3.1
4.3
EPSS
1%
Percentile
59.2
In the wild
Unconfirmed
What it is

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00896 · 59.2th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2020-06-29T19:45Z
EPSS history
Timeline
  • 29 JUN 19:45Z
    Open Redirect in OAuth2 Proxy
    cvelistv5