NVD Vulnerability Detail

CVE-2020-12283

Summary	Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
Publication Date	April 30, 2020, 2:15 p.m.
Registration Date	Jan. 26, 2021, 11:51 a.m.
Last Update	Nov. 21, 2024, 1:59 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:sourcegraph:sourcegraph::::::::					3.15.1

Related information, measures and tools

No	URL	タグ
1	https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md	Release Notes Third Party Advisory
2	https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64	Patch Third Party Advisory
3	https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1	Release Notes Third Party Advisory
4	https://github.com/sourcegraph/sourcegraph/pull/10167	Patch Third Party Advisory
5	https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph	Exploit Third Party Advisory
6	https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md	Release Notes Third Party Advisory
7	https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph	Exploit Third Party Advisory
8	https://github.com/sourcegraph/sourcegraph/pull/10167	Patch Third Party Advisory
9	https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1	Release Notes Third Party Advisory
10	https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64	Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-601	オープンリダイレクト	https://cwe.mitre.org/data/definitions/601.html

JVN Vulnerability Information

Sourcegraph におけるオープンリダイレクトの脆弱性

Title	Sourcegraph におけるオープンリダイレクトの脆弱性
Summary	Sourcegraph には、オープンリダイレクトの脆弱性が存在します。
Possible impacts	情報を取得される、および情報を改ざんされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 24, 2020, midnight
Registration Date	May 29, 2020, 3:47 p.m.
Last Update	May 29, 2020, 3:47 p.m.

Affected System

Sourcegraph

Sourcegraph 3.15.1 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2020-12283	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-12283
National Vulnerability Database (NVD)
2	CVE-2020-12283	https://nvd.nist.gov/vuln/detail/CVE-2020-12283

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-601	https://cwe.mitre.org/data/definitions/601.html

ベンダー情報

No	Name	URL
GitHub
1	auth: ensure the redirect URL always starts with a single slash #10167	https://github.com/sourcegraph/sourcegraph/pull/10167
2	auth: ensure the redirect URL always starts with a single slash (#10167)	https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64
3	Changelog	https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md
4	Comparing changes	https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1

Change Log

No	Changed Details	Date of change
1	[2020年05月29日] 掲載	May 29, 2020, 3:47 p.m.