CVE-2021-23495

Name of the Vulnerable Software and Affected Versions karma versions prior to 6.3.16

Description The issue is related to an Open Redirect vulnerability due to missing validation of the return url query parameter. This allows for potential redirection to unintended locations.

Recommendations For versions prior to 6.3.16, update to version 6.3.16 or later to resolve the issue. As a temporary workaround, consider validating the return url query parameter to ensure it points to an intended location within the application. Restrict access to the return url parameter in the affected API endpoint to minimize the risk of exploitation.