CVE-2020-5233

EUVD-2021-2572
OAuth2 Proxy before 5.0 has an open redirect vulnerability. Authentication tokens could be silently harvested by an attacker. This has been patched in version 5.0.
Open Redirect
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
GitHub_MCNA
5.9 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:H/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 51%
Affected Products (NVD)
VendorProductVersion
oauth2_proxy_projectoauth2_proxy
𝑥
< 5.0.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0
https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv
https://github.com/pusher/oauth2_proxy/commit/a316f8a06f3c0ca2b5fc5fa18a91781b313607b2
https://github.com/pusher/oauth2_proxy/releases/tag/v5.0.0
https://github.com/pusher/oauth2_proxy/security/advisories/GHSA-qqxw-m5fj-f7gv