CVE-2021-32721 MEDIUM

CVE-2021-32721: URL Redirection to Untrusted Site ('Open Redirect') in github.com/AndrewBurian/powermux

Vendor Andrewburian
Product powermux
Weakness CWE-601 · Open redirect
Published June 29, 2021
Last update August 3, 2024
View on NVD All CVEs

CVSS base score

4.7/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction Required
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

PowerMux is a drop-in replacement for Go's http.ServeMux. In PowerMux versions prior to 1.1.1, attackers may be able to craft phishing links and other open redirects by exploiting the trailing slash redirection feature. This may lead to users being redirected to untrusted sites after following an attacker crafted link. The issue is resolved in v1.1.1. There are no existing workarounds.

Key dates

02Disclosure timeline

June 29, 2021 CVE published
August 3, 2024 Record updated