| modules: |
| - module: gopkg.in/macaron.v1 |
| versions: |
| - fixed: 1.3.7 |
| packages: |
| - package: gopkg.in/macaron.v1 |
| symbols: |
| - staticHandler |
| derived_symbols: |
| - Context.Next |
| - LoggerInvoker.Invoke |
| - Macaron.Run |
| - Macaron.ServeHTTP |
| - Router.ServeHTTP |
| skip_fix: 'TODO: fill this out [or set vulnerable_at to derive symbols]' |
| description: | |
| Due to improper request santization, a specifically crafted URL |
| can cause the static file handler to redirect to an attacker chosen |
| URL, allowing for open redirect attacks. |
| published: 2021-04-14T20:04:52Z |
| cves: |
| - CVE-2020-12666 |
| ghsas: |
| - GHSA-733f-44f3-3frw |
| credit: '@ev0A' |
| references: |
| - fix: https://github.com/go-macaron/macaron/pull/199 |
| - fix: https://github.com/go-macaron/macaron/commit/addc7461c3a90a040e79aa75bfd245107a210245 |
| - web: https://github.com/go-macaron/macaron/issues/198 |
