Back to Database
Status published
Medium
CVE-2020-12283
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of...
Vulnerability Description
Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-12283
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/sourcegraph/sourcegraph/pull/10167
- https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1
- https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64
- https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.md
- https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraph
More from sourcegraph
View All →CVE-2023-46248
Overwrite of builtin Cody commands facilitates RCE
Critical
9.1
CVE-2022-41943
Incorrect default permissions found in Sourcegraph
Critical
9
CVE-2022-41942
Sourcegraph vulnerable to Comand Injection via gitserver
High
7.9
CVE-2022-31155
Unauthorized overwriting of saved searches in Sourcegraph
Medium
4.3
CVE-2022-31154
Indirect Object Access in Sourcegraph Code Monitoring
Medium
6.4
Affected Vendor
sourcegraph
View all reports →Affected Software
sourcegraph
Vulnerable Versions:
0
Timeline
Official Publish:
April 30th, 2020
Last Modified:
August 4th, 2024
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.