En bref
- CVE-2021-32645 est une vulnérabilité MOYENNE (CVSS 6.1) touchant hyn/multi-tenant, multi-tenant (tenancy).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 1.0%, plus élevée que 63.6% des vulnérabilités.
- Correctif : mettre à jour vers 5.7.2 ou plus récent.
Description
Impact
In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL.
This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have force_https set to true (default: false)
Patches
Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to.
Workarounds
There is a simple way to work around the security issue
- Set the
force_https to every tenant to false
References
https://nvd.nist.gov/vuln/detail/CVE-2018-11784
For more information
If you have any questions or comments about this advisory:
NVD description
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free