CVE-2020-4037 MEDIUM

CVE-2020-4037: Open Redirect in OAuth2 Proxy

Vendor Oauth2 Proxy
Product OAuth2 Proxy
Weakness CWE-601 · Open redirect
Published June 29, 2020
Last update August 4, 2024

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

What the vulnerability does

01Description

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.

Key dates

02Disclosure timeline

June 29, 2020 CVE published
August 4, 2024 Record updated