CVE-2023-35948: Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality
Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Novuto a version that resolves this vulnerability.Fixed in 0.16.0
Event History
Frequently Asked Questions
What is the severity of CVE-2023-35948?
CVE-2023-35948 is classified as a high-severity open redirect vulnerability.
How do I fix CVE-2023-35948?
To fix CVE-2023-35948, update to Novu version 0.16.0 or later.
What functionality is impacted by CVE-2023-35948?
CVE-2023-35948 affects the "Sign In with GitHub" functionality in Novu.
Which versions of Novu are vulnerable to CVE-2023-35948?
Versions of Novu prior to 0.16.0 are vulnerable to CVE-2023-35948.
What consequences can result from CVE-2023-35948?
CVE-2023-35948 could allow attackers to redirect users to malicious sites after signing in.