CVE-2020-15242

Katalog CVE

CVSS 6.1 · Medium EPSS 0,77%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada vercel next.js. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

Next.js versions >=9.5.0 and <9.5.4 are vulnerable to an Open Redirect. Specially encoded paths could be used with the trailing slash redirect to allow an open redirect to occur to an external site. In general, this redirect does not directly harm users although can allow for phishing attacks by redirecting to an attackers domain from a trusted domain. The issue is fixed in version 9.5.4.

Rincian

Terbit di NVD

8 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

0,77% peluang dieksploitasi; lebih tinggi dari 54,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/vercel/next.js/security/advisories/GHSA-x56p-c8cg-q435 patch · advisory pihak ketiga
• https://github.com/zeit/next.js/releases/tag/v9.5.4 release notes · advisory pihak ketiga