Vulnerability-Lookup

GHSA-5P9J-W2WX-QX4C

Vulnerability from github – Published: 2022-03-07 00:00 – Updated: 2022-03-14 21:19

Summary

Open Redirect in django-spirit

Details

django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.

Severity

6.1 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "django-spirit"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.12.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-03-07T20:17:27Z",
    "nvd_published_at": "2022-03-06T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn\u0027t check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.",
  "id": "GHSA-5p9j-w2wx-qx4c",
  "modified": "2022-03-14T21:19:27Z",
  "published": "2022-03-07T00:00:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0869"
    },
    {
      "type": "WEB",
      "url": "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/nitely/spirit"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Open Redirect in django-spirit"
}

CVE-2022-0869 (GCVE-0-2022-0869)

Vulnerability from cvelistv5 – Published: 2022-03-06 09:20 – Updated: 2024-08-02 23:40

Title

Multiple Open Redirect in nitely/spirit

Summary

Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

CWE

CWE-601 - URL Redirection to Untrusted Site

Assigner

@huntrdev

References

2 references

URL	Tags
https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac8…	x_refsource_CONFIRM
https://github.com/nitely/spirit/commit/8f32f8965…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
nitely	nitely/spirit	Affected: unspecified , < 0.12.3 (custom)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T23:40:04.524Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "nitely/spirit",
          "vendor": "nitely",
          "versions": [
            {
              "lessThan": "0.12.3",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-601",
              "description": "CWE-601 URL Redirection to Untrusted Site",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-03-06T09:20:09.000Z",
        "orgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
        "shortName": "@huntrdev"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef"
        }
      ],
      "source": {
        "advisory": "ed335a88-f68c-4e4d-ac85-f29a51b03342",
        "discovery": "EXTERNAL"
      },
      "title": "Multiple Open Redirect in nitely/spirit",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@huntr.dev",
          "ID": "CVE-2022-0869",
          "STATE": "PUBLIC",
          "TITLE": "Multiple Open Redirect in nitely/spirit"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "nitely/spirit",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.12.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "nitely"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-601 URL Redirection to Untrusted Site"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342",
              "refsource": "CONFIRM",
              "url": "https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342"
            },
            {
              "name": "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef",
              "refsource": "MISC",
              "url": "https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef"
            }
          ]
        },
        "source": {
          "advisory": "ed335a88-f68c-4e4d-ac85-f29a51b03342",
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a",
    "assignerShortName": "@huntrdev",
    "cveId": "CVE-2022-0869",
    "datePublished": "2022-03-06T09:20:09.000Z",
    "dateReserved": "2022-03-06T00:00:00.000Z",
    "dateUpdated": "2024-08-02T23:40:04.524Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-5P9J-W2WX-QX4C

CVE-2022-0869 (GCVE-0-2022-0869)

Tags

Sightings

Nomenclature