id: GO-2020-0039
modules:
    - module: gopkg.in/macaron.v1
      versions:
        - fixed: 1.3.7
      vulnerable_at: 1.3.6
      packages:
        - package: gopkg.in/macaron.v1
          symbols:
            - staticHandler
          derived_symbols:
            - Context.Next
            - LoggerInvoker.Invoke
            - Macaron.Run
            - Macaron.ServeHTTP
            - Router.ServeHTTP
summary: Open redirect in gopkg.in/macaron.v1
description: |-
    Due to improper request sanitization, a specifically crafted URL can cause the
    static file handler to redirect to an attacker chosen URL, allowing for open
    redirect attacks.
published: 2021-04-14T20:04:52Z
cves:
    - CVE-2020-12666
ghsas:
    - GHSA-733f-44f3-3frw
credits:
    - '@ev0A'
references:
    - fix: https://github.com/go-macaron/macaron/pull/199
    - fix: https://github.com/go-macaron/macaron/commit/addc7461c3a90a040e79aa75bfd245107a210245
    - web: https://github.com/go-macaron/macaron/issues/198