CVE-2021-23435.yml

---
gem: clearance
cve: 2021-23435
ghsa: 4hpq-rjcx-7vj9
url: https://github.com/advisories/GHSA-4hpq-rjcx-7vj9
title: Open Redirect in clearance
date: 2021-09-13
description: |
  This affects the package clearance before 2.5.0. The vulnerability can
  be possible when users are able to set the value of session[:return_to]. If the
  value used for return_to contains multiple leading slashes (/////example.com) the
  user ends up being redirected to the external domain that comes after the slashes
  (http://example.com).
cvss_v3: 7.6
patched_versions:
  - ">= 2.5.0"