{"id":"CVE-2020-12666","aliases":["EUVD-2021-0982","GHSA-733f-44f3-3frw","GO-2020-0039","RHSA-2020:3369"],"status":"published","title":"gopkg.in/macaron.v1 Open Redirect vulnerability","description":"macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0141,"percentile":0.72845,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2020-05-05T21:06:59Z","modified":"2026-10-20T10:51:46Z","fixes":[{"ecosystem":"Go","package":"gopkg.in/macaron.v1","fixed_in":["1.3.7"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gopkg.in/macaron.v1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.7"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/macaron.v1","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.7"}]}]},{"source":"osv","ecosystem":"Go","package":"gopkg.in/macaron.v1","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.7"}]}]},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el7","package":"kiali","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:v1.12.10.redhat2-1.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"ior","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-citadel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-cni","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-galley","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-grafana-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.3-13.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-istioctl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-mixs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-operator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-2.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-pilot-discovery","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.14.0-14.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:service_mesh:1.1::el8","package":"servicemesh-sidecar-injector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.1.6-1.el8"}]}],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"go-macaron","product":"macaron"}],"references":[{"url":"https://github.com/go-macaron/macaron/releases/tag/v1.3.7","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","advisory","web"]},{"url":"https://github.com/go-macaron/macaron/issues/198","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QEUOHRC4EN4WZ66EVFML2UCV7ZQ63XZ/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-12666","tags":["advisory"]},{"url":"https://github.com/go-macaron/macaron/issues/198#issuecomment-622885959","tags":["web"]},{"url":"https://github.com/go-macaron/macaron/pull/199/commits/6bd9385542f7133467ab7d09a5f28f7d5dc52af7","tags":["web"]},{"url":"https://github.com/go-macaron/macaron/pull/199","tags":["web","fix"]},{"url":"https://github.com/go-macaron/macaron/commit/addc7461c3a90a040e79aa75bfd245107a210245","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2020-0039","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3QEUOHRC4EN4WZ66EVFML2UCV7ZQ63XZ","tags":["web"]},{"url":"https://github.com/advisories/GHSA-733f-44f3-3frw"},{"url":"https://github.com/go-macaron/macaron","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3369","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1853652","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1857412","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3369.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8203","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8203","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","tags":["advisory"]},{"url":"https://hackerone.com/reports/712065","tags":["article"]},{"url":"https://www.npmjs.com/advisories/1523","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9283","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-11023","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-11023","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-11023","tags":["advisory"]},{"url":"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-12666","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-12666","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14040","tags":["advisory"]},{"url":"https://github.com/golang/go/issues/39491","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/bXVeAmGOqz0","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2020-12666","description":"macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.","status":"published","published":"2020-05-05T21:06:59Z","modified":"2024-08-04T12:04:22.507Z","updated_at":"2026-11-02T14:35:52.925152Z"}],"euvd":[{"id":"EUVD-2021-0982","description":"macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.","status":"published","published":"2020-05-05T21:06:59Z","modified":"2024-08-04T12:04:22Z","updated_at":"2026-11-03T03:07:39.298733Z"}],"ghsa":[{"id":"GHSA-733f-44f3-3frw","title":"gopkg.in/macaron.v1 Open Redirect vulnerability","description":"macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.","status":"published","published":"2021-05-18T21:08:35Z","modified":"2024-05-20T19:24:05Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2020-12666","description":"macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.","status":"published","published":"2020-05-05T22:15:13.027Z","modified":"2026-06-17T02:52:06.073Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:05:59.718774Z"}],"osv":[{"id":"CVE-2020-12666","description":"macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.","status":"published","published":"2020-05-05T22:15:13.027Z","modified":"2026-11-10T02:45:08.757611304Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T10:53:57.550641Z"},{"id":"GHSA-733f-44f3-3frw","title":"gopkg.in/macaron.v1 Open Redirect vulnerability","description":"macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.","status":"published","published":"2021-05-18T21:08:35Z","modified":"2024-05-20T19:24:04Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:40.308826Z"},{"id":"RHSA-2020:3369","title":"Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update","status":"published","published":"2024-09-30T13:53:57Z","modified":"2026-10-19T10:01:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"GO-2020-0039","title":"Open redirect in gopkg.in/macaron.v1","description":"Due to improper request sanitization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}