URL Redirection to Untrusted Site (Open Redirect) in Ktor

2020-02-1218:45:50

Google

osv.dev

0.001 Low

EPSS

Percentile

43.3%

JSON

In Ktor through 1.2.6, the client resends data from the HTTP Authorization header to a redirect location.

CPENameOperatorVersion
io.ktor:ktor-client-coreeq1.0.1
io.ktor:ktor-client-coreeq1.2.6
io.ktor:ktor-client-coreeq1.1.0
io.ktor:ktor-client-coreeq1.1.3
io.ktor:ktor-client-coreeq1.1.5
io.ktor:ktor-client-coreeq1.2.0-rc2
io.ktor:ktor-client-coreeq1.2.5
io.ktor:ktor-client-coreeq1.3.0-rc2
io.ktor:ktor-client-coreeq1.2.2
io.ktor:ktor-client-coreeq1.1.1

Name	Operator	Version
io.ktor:ktor-client-core	eq	1.0.1
io.ktor:ktor-client-core	eq	1.2.6
io.ktor:ktor-client-core	eq	1.1.0
io.ktor:ktor-client-core	eq	1.1.3
io.ktor:ktor-client-core	eq	1.1.5
io.ktor:ktor-client-core	eq	1.2.0-rc2
io.ktor:ktor-client-core	eq	1.2.5
io.ktor:ktor-client-core	eq	1.3.0-rc2
io.ktor:ktor-client-core	eq	1.2.2
io.ktor:ktor-client-core	eq	1.1.1