Skip to content
Fencer Intel
medium 6.1

CVE-2020-12666 json

gopkg.in/macaron.v1 Open Redirect vulnerability

published 6y ago modified 4mo ago also GHSA-733f-44f3-3frw , GO-2020-0039 , EUVD-2021-0982

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

Patch / fix

  • go gopkg.in/macaron.v1 1.3.7
  • go-macaron macaron 1.3.7
  • ior service mesh 1.1 1.1.6-1.el8
  • kiali service mesh 1.1 v1.12.10.redhat2-1.el7
  • servicemesh service mesh 1.1 1.1.6-1.el8
  • servicemesh-cni service mesh 1.1 1.1.6-1.el8
  • servicemesh-mixc service mesh 1.1 1.1.6-1.el8
  • servicemesh-mixs service mesh 1.1 1.1.6-1.el8
  • servicemesh-galley service mesh 1.1 1.1.6-1.el8
  • servicemesh-citadel service mesh 1.1 1.1.6-1.el8

red hat advisories RHSA-2020:3369

Is CVE-2020-12666 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-12666 updated cvss 6.1

macaron: open redirect in the static handler

  • Red Hat Ceph Storage 2 grafana
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 grafana, grafana-container Red Hat Ceph Storage 4 rhceph/rhceph-4-dashboard-rhel8 Red Hat OpenShift Container Platform 3.11 openshift3/grafana Red Hat OpenShift Container Platform 4 openshift4/ose-grafana Red Hat Storage 3 grafana
    affected: no fix available “Fix deferred”
  • Red Hat OpenShift Service Mesh 1.1 ior 1.1.6-1.el8, servicemesh 1.1.6-1.el8, servicemesh-cni 1.1.6-1.el8, servicemesh-mixc 1.1.6-1.el8, servicemesh-mixs 1.1.6-1.el8, servicemesh-galley 1.1.6-1.el8, +9 more Red Hat OpenShift Service Mesh 1.1 kiali v1.12.10.redhat2-1.el7
    fixed: vendor fix RHSA-2020:3369

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.41% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/go-macaron/macaron/issues/198 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 5.8 AV:N/AC:M/Au:N/C:P/I:P/A:N
GitHub 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
go gopkg.in/macaron.v1
<1.3.7
1.3.7

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.