CVE-2020-12283 Open redirect vulnerability in Sourcegraph

What is CVE-2020-12283?

CVE-2020-12283 is a medium-severity vulnerability in n/a, published on 30 Apr 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.

Weakness: CWE-601

Which versions are affected by CVE-2020-12283?

4 open source packages ship an affected version, including github.com/sourcegraph/sourcegraph. It affects 1 product.

Products include Sourcegraph Sourcegraph.

How do I fix CVE-2020-12283?

Upgrade github.com/sourcegraph/sourcegraph to a fixed version for your release line: 3.14.4 or 3.15.1.

Is CVE-2020-12283 being exploited?

There is no known exploitation of CVE-2020-12283 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-41943 Incorrect default permissions found in Sourcegraph Critical 9.0
• CVE-2022-23642 Code Injection in Sourcegraph High 8.8
• CVE-2022-41942 Sourcegraph vulnerable to Comand Injection via gitserver High 7.9
• CVE-2022-29171 Remote Code Execution in sourcegraph Medium 6.6
• CVE-2022-23643 Side-channel attack in Sourcegraph Code Monitors Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-mx43-r985-5h4m.