What is GHSA-rc3x-jf5g-xvc5?

GHSA-rc3x-jf5g-xvc5 is a security advisory published by GitHub Security Advisories with Medium severity. Open redirect in karma

Which CVE IDs does GHSA-rc3x-jf5g-xvc5 cover?

GHSA-rc3x-jf5g-xvc5 covers the following CVE IDs: CVE-2021-23495. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rc3x-jf5g-xvc5?

GHSA-rc3x-jf5g-xvc5 has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-rc3x-jf5g-xvc5?

GHSA-rc3x-jf5g-xvc5 affects 1 product, including: npm/karma:\u003c 6.3.16.

GHSA-rc3x-jf5g-xvc5MediumCVSS 5.4

Open redirect in karma

Vendor

GitHub Security Advisories

Published

February 26, 2022

Last Modified

February 3, 2023

🔗 CVE IDs covered (1)

CVE-2021-23495 →

📋 Description

Karma before 6.3.16 is vulnerable to Open Redirect due to missing validation of the return_url query parameter.

🎯 Affected products1

npm/karma:< 6.3.16

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2021-23495
https://github.com/karma-runner/karma/commit/ff7edbb2ffbcdd69761bece86b7dc1ef0740508d
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2412347
https://snyk.io/vuln/SNYK-JS-KARMA-2396325
https://github.com/advisories/GHSA-rc3x-jf5g-xvc5