Vulnerability Details : CVE-2020-15242
Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.
Vulnerability category: Open redirect
Products affected by CVE-2020-15242
- cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-15242
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 29 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-15242
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
5.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:N |
8.6
|
4.9
|
NIST | |
6.1
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
2.8
|
2.7
|
NIST | |
4.7
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N |
2.8
|
1.4
|
GitHub, Inc. |
CWE ids for CVE-2020-15242
-
The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.Assigned by: security-advisories@github.com (Primary)
References for CVE-2020-15242
-
https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435
Open Redirect in Next.js versions between 9.5.0 and 9.5.3 · Advisory · vercel/next.js · GitHubPatch;Third Party Advisory
-
https://github.com/zeit/next.js/releases/tag/v9.5.4
Release v9.5.4 · vercel/next.js · GitHubRelease Notes;Third Party Advisory
Jump to