CVE-2021-32645 Open Redirect in tenancy

2021-05-2716:50:11

CWE-601

GitHub_M

www.cve.org

vulnerability

open redirect

multi-tenant

laravel

security issue

patch

force https

CVSS3

4.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS

0.001

Percentile

43.6%

JSON

Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have force_https set to true (default: false). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL’s from being redirected to. As a work around users can set the force_https to every tenant to false, however this may degrade connection security.

CNA Affected

[
  {
    "product": "multi-tenant",
    "vendor": "tenancy",
    "versions": [
      {
        "status": "affected",
        "version": ">=5.6.0, < 5.7.2"
      }
    ]
  }
]