GHSA-4hpq-rjcx-7vj9

    Dashboard / Vulnerabilities / GHSA-4hpq-rjcx-7vj9

    GHSA-4hpq-rjcx-7vj9

    Published: 13 Sept 2021Last Modified: 8 Jul 2026

    Summary: Clearance Gem Open Redirect Vulnerability

    Details: This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of `session[:return_to]`. If the value used for return_to contains multiple leading slashes (`/////example.com`) the user ends up being redirected to the external domain that comes after the slashes (`http://example.com`).

    References: https://nvd.nist.gov/vuln/detail/CVE-2021-23435, https://github.com/thoughtbot/clearance/pull/945, https://github.com/advisories/GHSA-4hpq-rjcx-7vj9, https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clearance/CVE-2021-23435.yml, https://github.com/thoughtbot/clearance, https://snyk.io/vuln/SNYK-RUBY-CLEARANCE-1577284

    Affected packages

    Package

    Name: clearance

    Purl: pkg:gem/clearance

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.5.0

    Affected versions

    0.10.0
    0.10.1
    0.10.2
    0.10.3.2
    0.10.4
    0.10.5

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-4hpq-rjcx-7vj9 | CVE-DB