{
"id": "GHSA-733f-44f3-3frw",
"aliases": [
"CVE-2020-12666"
],
"details": "macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.",
"summary": "gopkg.in/macaron.v1 Open Redirect vulnerability",
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.7"
}
]
}
],
"package": {
"name": "gopkg.in/macaron.v1",
"ecosystem": "Go"
}
}
],
"modified": "2024-05-20T19:24:04Z",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"published": "2021-05-18T21:08:35Z",
"references": [
{
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12666",
"type": "ADVISORY"
},
{
"url": "https://github.com/go-macaron/macaron/issues/198",
"type": "WEB"
},
{
"url": "https://github.com/go-macaron/macaron/issues/198#issuecomment-622885959",
"type": "WEB"
},
{
"url": "https://github.com/go-macaron/macaron/pull/199",
"type": "WEB"
},
{
"url": "https://github.com/go-macaron/macaron/pull/199/commits/6bd9385542f7133467ab7d09a5f28f7d5dc52af7",
"type": "WEB"
},
{
"url": "https://github.com/go-macaron/macaron/commit/addc7461c3a90a040e79aa75bfd245107a210245",
"type": "WEB"
},
{
"url": "https://github.com/go-macaron/macaron",
"type": "PACKAGE"
},
{
"url": "https://github.com/go-macaron/macaron/releases/tag/v1.3.7",
"type": "WEB"
},
{
"url": "https://lists.fedoraproject.org/archives/list/[email protected] /message/3QEUOHRC4EN4WZ66EVFML2UCV7ZQ63XZ",
"type": "WEB"
},
{
"url": "https://pkg.go.dev/vuln/GO-2020-0039",
"type": "WEB"
}
],
"schema_version": "1.4.0",
"database_specific": {
"cwe_ids": [
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": true,
"nvd_published_at": "2020-05-05T22:15:00Z",
"github_reviewed_at": "2021-05-18T20:50:16Z"
}
}