CVE-2020-12666: Medium severity go-macaron vulnerability
A flaw was found in macaron. Path URLs aren't cleaned before being redirected creating an open redirect in the static handler.
Other sources
macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.
macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this flaw in macaron?
The vulnerability ID is CVE-2020-12666.
What is the severity level of CVE-2020-12666?
The severity level of CVE-2020-12666 is medium.
Which software versions are affected by CVE-2020-12666?
The affected software versions are macaron before 1.3.7, gopkg.in/macaron.v1 before 1.3.7, and redhat/macaron before 1.3.7.
What is the vulnerability description of CVE-2020-12666?
CVE-2020-12666 is a flaw in macaron that allows for open redirect attacks due to improper request sanitization.
Where can I find more information about CVE-2020-12666?
You can find more information about CVE-2020-12666 at the following references: [CVE-2020-12666](https://www.cve.org/CVERecord?id=CVE-2020-12666), [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-12666), [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1850034), [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2020:3369).