CVE-2021-32645

    Dashboard / Vulnerabilities / CVE-2021-32645

    CVE-2021-32645

    Published: 27 May 2021Last Modified: 9 Jul 2026

    Summary:

    Details: Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.

    References: https://github.com/tenancy/multi-tenant/security/advisories/GHSA-4r8q-gv9j-3xx6, https://packagist.org/packages/hyn/multi-tenant, https://webmasters.googleblog.com/2009/01/open-redirect-urls-is-your-site-being.html, https://github.com/tenancy/multi-tenant/commit/9c837a21bccce9bcaeb90033ef200d84f0d9e164

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 785c4482d268cab6d8e20d8ea3240940a4f74f62
    Fixed -e5afd7b443523d4002ec3520dadb7e02dc4e1d86

    Affected versions

    5.7.1
    5.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32645 | CVE-DB