CVE-2020-12283
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2020-12283
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2020-12283.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2020-12283
- Aliases
- Withdrawn
- 2024-08-20T03:55:55.522692Z
- Published
- 2020-04-30T05:15:11Z
- Modified
- 2024-05-09T10:07:16.935296Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
- References
-
- https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph
- https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64
- https://github.com/sourcegraph/sourcegraph/pull/10167
- https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md
- https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1
Affected packages
Git / github.com/sourcegraph/sourcegraph
Affected ranges
- Type
- GIT
- Repo
- https://github.com/sourcegraph/sourcegraph
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixed
Affected versions
v2.*
v2.0.0
v2.0.1
v2.0.2
v3.*
v3.0.0
v3.0.0-alpha.1
v3.0.0-alpha.10
v3.0.0-alpha.11
v3.0.0-alpha.12
v3.0.0-alpha.2
v3.0.0-alpha.3
v3.0.0-alpha.4
v3.0.0-alpha.5
v3.0.0-alpha.6
v3.0.0-alpha.7
v3.0.0-alpha.8
v3.0.0-alpha.9
v3.0.0-beta
v3.0.0-beta.2
v3.0.0-beta.4
v3.0.0-rc.1
v3.0.1-rc.1
v3.0.2
v3.1.0-rc.1
v3.10.0-rc.1
v3.11.0-rc.2
v3.13.0-rc.1
v3.14.0-rc.1
v3.15.0
v3.15.0-rc.1
v3.15.0-rc.2
v3.15.0-rc.3
v3.15.0-rc.4
v3.15.0-rc.5
v3.15.0-rc.6
v3.15.0-rc.7
v3.3.0-rc.1
v3.4.0-rc.1
v3.5.0-rc.1
v3.6.0-rc.1
v3.7.0-rc.1
v3.8.0-rc.1
v3.8.0-rc.2
v3.9.0-rc.1
v3.9.0-rc.2