GHSA-xm3x-4ph3-3x9c json
friendsofsymfony/oauth2-php open redirection in oauth
published 2y ago modified last yr.
- cvss
- —
- not scored
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
An open redirection vulnerability has been identified in the friendsofsymfony/oauth2-php library, which could potentially expose users to unauthorized redirects during the OAuth authentication process. This vulnerability has been addressed by implementing an exact check for the domain and port, ensuring more secure redirection.
Patch / fix
- packagist friendsofsymfony/oauth2-php 1.3.0
Is GHSA-xm3x-4ph3-3x9c in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerAffected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | friendsofsymfony/oauth2-php | <1.3.0 |
1.3.0 |
References
-
github.com
/FriendsOfSymfony/oauth2-php/commit/606b8ea1c3c927c272ac1409116332ad5a2ed94c
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/friendsofsymfony/oauth2-php/2020-03-03-1.yaml
web
-
github.com
/FriendsOfSymfony/oauth2-php
package
-
github.com
/FriendsOfSymfony/oauth2-php/releases/tag/1.3.0
web
Sources
- GitHub Advisory GHSA-xm3x-4ph3-3x9c
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.