CVE-2023-35948CWE-601

Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality

Medium · published July 6, 2023

CVSS v3.1
5.4
EPSS
0%
Percentile
32.3
In the wild
Unconfirmed
What it is

Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00393 · 32.3th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2023-07-06T14:47Z
EPSS history
Timeline
  • 06 JUL 14:47Z
    Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality
    cvelistv5