Open Redirect in Sourcegraph
CVE-2020-12283
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
Vulnerability class: Open Redirect
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.1 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.013 (70.0th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 70.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: +0.000
Affected products
Weakness classification (CWE)
References
- github.com/sourcegraph/sourcegraph/pull/10167 (Patch, Third Party Advisory)
- github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1 (Third Party Advisory, Release Notes)
- github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77… (Patch, Third Party Advisory)
- github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md (Third Party Advisory, Release Notes)
- securitylab.github.com/advisories/GHSL-2020-085-sourcegraph (Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-12283?
- CVE-2020-12283 is a medium-severity vulnerability in Sourcegraph, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 6.1/10. Published 2020-04-30.
- How severe is CVE-2020-12283?
- Medium severity. CVSS v3 base score is 6.1 out of 10.