Open redirect in URI.js - CVE-2021-3647

Vulnerability details

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

Affected software

How to mitigate CVE-2021-3647

External References

• https://github.com/medialize/URI.js/commit/ac43ca8f80c042f0256fb551ea5203863dec4481
• https://huntr.dev/bounties/1625558772840-medialize/URI.js

Related Security Bulletins

• Open redirect in URI.js package for npm