CVE-2021-23435

CVE-2021-23435 affects the Ruby gem clearance (Rails authentication). The open redirect vulnerability occurs when session[:return_to] is set to a value that includes multiple leading slashes (/////example.com), causing a redirect to an external domain after the slashes (e.g., http://example.com)....

CVE-2021-23435

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session:returnto. If the value used for returnto contains multiple leading slashes /////example.com the user ends up being redirected to the external domain that comes after...