CVE-2020-4037: oauth2 proxy project oauth2 proxy

csirt@kutim:~/threat-intel/cve/CVE-2020-4037

CVSS 5.4 · Medium EPSS 0,90%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada oauth2 proxy project oauth2 proxy. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

In OAuth2 Proxy from version 5.1.1 and less than version 6.0.0, users can provide a redirect address for the proxy to send the authenticated user to at the end of the authentication flow. This is expected to be the original URL that the user was trying to access. This redirect URL is checked within the proxy and validated before redirecting the user to prevent malicious actors providing redirects to potentially harmful sites. This has been fixed in version 6.0.0.

Rincian

Terbit di NVD: 29 Juni 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
EPSS (30 hari): 0,90% peluang dieksploitasi; lebih tinggi dari 58,4% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
oauth2 proxy project	oauth2 proxy	Versi 5.1.1 hingga sebelum 6.0.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/oauth2-proxy/oauth2-proxy/commit/ee5662e0f5001d76ec76562bb605abbd07c266a2 patch · advisory pihak ketiga
https://github.com/oauth2-proxy/oauth2-proxy/security/advisories/GHSA-5m6c-jp6f-2vcv advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.