FKIE_CVE-2021-32645

Vulnerability from fkie_nvd - Published: 2021-05-27 17:15 - Updated: 2026-06-17 03:53
Severity
6.1 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Summary
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
References
security-advisories@github.comhttps://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164Patch, Third Party Advisory
security-advisories@github.comhttps://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6Mitigation, Third Party Advisory
security-advisories@github.comhttps://packagist.org/packages/hyn/multi-tenantProduct, Third Party Advisory
security-advisories@github.comhttps://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.htmlThird Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164Patch, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://packagist.org/packages/hyn/multi-tenantProduct, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.htmlThird Party Advisory
Impacted products
Vendor Product Version
tenancy multi-tenant *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "multi-tenant",
          "vendor": "tenancy",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e=5.6.0, \u003c 5.7.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:tenancy:multi-tenant:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "694DCF0D-2851-4E42-8F9C-A74FA84527D2",
              "versionEndExcluding": "5.7.2",
              "versionStartIncluding": "5.6.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL\u0027s from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security."
    },
    {
      "lang": "es",
      "value": "Tenancy multi-tenant es un controlador multidominio de c\u00f3digo abierto para el Laravel web framework.\u0026#xa0;En algunas situaciones, es posible tener redireccionamientos abiertos donde los usuarios pueden ser redirigidos desde su sitio a cualquier otro sitio usando una URL especialmente dise\u00f1ada.\u0026#xa0;Este es solo el caso de instalaciones donde es usado la Identificaci\u00f3n de Nombre de Host predeterminada y el entorno usa inquilinos que presentan la funci\u00f3n \"force_https\" ajustada en el par\u00e1metro \"true\" (por defecto: \"false\").\u0026#xa0;La versi\u00f3n 5.7.2 contiene los parches relevantes para corregir este error.\u0026#xa0;Eliminar la URL de los caracteres especiales para impedir que se redireccione a las URL especialmente dise\u00f1adas.\u0026#xa0;Como soluci\u00f3n alternativa, los usuarios pueden ajustar la funci\u00f3n \"force_https\" para cada inquilino en el par\u00e1metro \"false\", sin embargo, esto puede degradar la seguridad de la conexi\u00f3n"
    }
  ],
  "id": "CVE-2021-32645",
  "lastModified": "2026-06-17T03:53:20.347",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 5.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 4.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-05-27T17:15:08.127",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://packagist.org/packages/hyn/multi-tenant"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Mitigation",
        "Third Party Advisory"
      ],
      "url": "https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Product",
        "Third Party Advisory"
      ],
      "url": "https://packagist.org/packages/hyn/multi-tenant"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-601"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.