CVE-2021-37699CWE-601

Open Redirect in Next.js versions below 11.1.0

Medium · published August 11, 2021

CVSS v3.1
6.9
EPSS
1%
Percentile
63.5
In the wild
Unconfirmed
What it is

Next.js is an open source website development framework to be used with the React library. In affected versions specially encoded paths could be used when pages/_error.js was statically generated allowing an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attacker's domain from a trusted domain. We recommend everyone to upgrade regardless of whether you can reproduce the issue or not. The issue has been patched in release 11.1.0.

The record
Technical detail
CVSS v3.1
6.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01033 · 63.5th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-08-11T23:15Z
EPSS history
Timeline
  • 11 AUG 23:15Z
    Open Redirect in Next.js versions below 11.1.0
    cvelistv5