An open redirect vulnerability that allows users to be targeted for phishing attacks has been found in Sourcegraph instances configured with OAuth, OpenID, or SAML authentication enabled. Users targeted by these phishing attacks could have their authentication tokens silently harvested by an attacker.
github.com/sourcegraph/sourcegraph/cmd/frontend/auth
Sourcegraph v3.14.4 and v3.15.1 have been released which resolve the vulnerability. (associated change)
Disabling OAuth, OpenID and/or SAML sign-in options until upgraded to the patched versions will secure Sourcegraph / workaround the issue.
If you have any questions or comments about this advisory, please contact us at support@sourcegraph.com and include CVE-2020-12283
in the title.
{ "nvd_published_at": null, "cwe_ids": [ "CWE-601" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2021-05-24T21:06:22Z" }