URL Redirection to Untrusted Site (Open Redirect) in Ktor · CVE-2019-19703 · GitHub Advisory Database · GitHub

URL Redirection to Untrusted Site (Open Redirect) in Ktor

Moderate severity GitHub Reviewed Published Feb 12, 2020 to the GitHub Advisory Database • Updated Jan 9, 2023

Package

io.ktor:ktor-client-core (Maven)

Affected versions

<= 1.2.6

Patched versions

1.3.0

Description

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

References

Reviewed Feb 11, 2020

Published to the GitHub Advisory Database Feb 12, 2020

Last updated Jan 9, 2023

Severity

Moderate

6.1

/ 10

CVSS base metrics

Attack vector

Network

Attack complexity

Low

Privileges required

None

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N