CVE-2020-15242: medium-severity vulnerability in vercel next.js
Open Redirect in Next.js
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Next.js versions 9.5.0 to 9.5.3 have a flaw that allows attackers to redirect users to external websites by manipulating specially encoded URL paths. While the redirect itself doesn't cause direct damage, it can be used for phishing attacks to trick users into visiting malicious sites.
An open redirect vulnerability exists in Next.js trailing slash redirect handling where specially encoded paths bypass validation and redirect to attacker-controlled external domains. The attack requires only a crafted URL and affects versions 9.5.0 through 9.5.3, enabling credential harvesting and phishing campaigns through trusted domain redirects.
In the same product, most dangerous first.