Open Redirect Affecting rack-cas package, versions >=0.0.0
Snyk CVSS
Attack Complexity
Low
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-RACKCAS-20390
- published 2 Aug 2017
- disclosed 5 Dec 2016
- credit Dawn Richardson
How to fix?
There is no fix version for rack-cas.
Overview
rack-cas is a simple CAS authentication for Rails, Sinatra or any Rack-based site.
Affected versions of the package are vulnerable to Open Redirection. It is possible to cause a seemingly trustworthy link redirect to a malicious site, controlled by an attacker, allowing them to conduct a phishing scam to steal user credentials.