{"id":"CVE-2021-23435","aliases":["EUVD-2021-1974","GHSA-4hpq-rjcx-7vj9","SNYK-RUBY-CLEARANCE-1577284"],"status":"published","title":"Open Redirect","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00703,"percentile":0.53718,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2021-09-12T20:05:10Z","modified":"2026-10-20T10:54:32Z","fixes":[{"ecosystem":"RubyGems","package":"clearance","fixed_in":["2.5.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"clearance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"clearance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}],"versions":["0.10.0","0.10.1","0.10.2","0.10.3.2","0.10.4","0.10.5","0.11.0","0.11.1","0.11.2","0.12.0","0.13.0","0.13.2","0.14.0","0.15.0","0.16.0","0.16.1","0.16.2","0.16.3","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.9.0.rc1","0.9.0.rc2","0.9.0.rc3","0.9.0.rc4","0.9.0.rc5","0.9.0.rc6","0.9.0.rc7","0.9.0.rc8","0.9.0.rc9","0.9.1","1.0.0","1.0.0.rc1","1.0.0.rc2","1.0.0.rc3","1.0.0.rc4","1.0.0.rc6","1.0.0.rc7","1.0.0.rc8","1.0.1","1.1.0","1.10.1","1.11.0","1.12.0","1.12.1","1.13.0","1.14.0","1.14.1","1.14.2","1.15.0","1.15.1","1.16.0","1.16.1","1.16.2","1.17.0","1.2.0","1.2.1","1.3.0","1.4.0","1.4.1","1.4.2","1.4.3","1.5.0","1.5.1","1.6.0","1.6.1","1.7.0","1.8.0","1.8.1","1.9.0","2.0.0","2.0.0.beta1","2.0.0.beta2","2.1.0","2.2.0","2.2.1","2.3.0","2.3.1","2.4.0"]}],"products":[{"vendor":"thoughtbot","product":"clearance"}],"references":[{"url":"https://snyk.io/vuln/SNYK-RUBY-CLEARANCE-1577284","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/thoughtbot/clearance/pull/945","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-23435","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4hpq-rjcx-7vj9","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/clearance/CVE-2021-23435.yml","tags":["web"]},{"url":"https://github.com/thoughtbot/clearance","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2021-23435","title":"Open Redirect","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).","status":"published","published":"2021-09-12T20:05:10.404Z","modified":"2024-09-16T23:55:46.556Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"cna"}],"updated_at":"2026-11-02T14:33:00.819444Z"}],"euvd":[{"id":"EUVD-2021-1974","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).","status":"published","published":"2021-09-12T20:05:10Z","modified":"2024-09-16T23:55:46Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:29:03.911526Z"}],"ghsa":[{"id":"GHSA-4hpq-rjcx-7vj9","title":"Clearance Gem Open Redirect Vulnerability","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of `session[:return_to]`. If the value used for return_to contains multiple leading slashes (`/////example.com`) the user ends up being redirected to the external domain that comes after the slashes (`http://example.com`).","status":"published","published":"2021-09-13T20:05:09Z","modified":"2023-08-25T20:56:58Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:37:00.680009Z"}],"nvd":[{"id":"CVE-2021-23435","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).","status":"published","published":"2021-09-12T20:15:07.443Z","modified":"2026-06-17T03:38:45.49Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:58.502206Z"}],"osv":[{"id":"CVE-2021-23435","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).","status":"published","published":"2021-09-12T20:15:07.443Z","modified":"2026-10-20T10:54:32.65353392Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-4hpq-rjcx-7vj9","title":"Clearance Gem Open Redirect Vulnerability","description":"This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of `session[:return_to]`. If the value used for return_to contains multiple leading slashes (`/////example.com`) the user ends up being redirected to the external domain that comes after the slashes (`http://example.com`).","status":"published","published":"2021-09-13T20:05:09Z","modified":"2026-07-08T06:49:52.790771388Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:37.148947Z"}]}}