Novu Open Redirect Vulnerability in Sign-In with GitHub Functionality
CVE-2023-35948

5.4MEDIUM

Key Information:

Vendor

Novuhq

Status
Novu
Vendor
CVE Published:
6 July 2023

What is CVE-2023-35948?

Novu provides an API for sending notifications through multiple channels. Versions prior to 0.16.0 contain an open redirect vulnerability in the "Sign In with GitHub" functionality of Novu's open-source repository. It could have allowed an attacker to force a victim into opening a malicious URL and thus, potentially log into the repository under the victim's account gaining full control of the account. This vulnerability only affected the Novu Cloud and Open-Source deployments if the user manually enabled the GitHub OAuth on their self-hosted instance of Novu. Users should upgrade to version 0.16.0 to receive a patch.

Affected Version(s)

novu < 0.16.0

References

https://github.com/novuhq/novu/security/advisories/GHSA-x...
x_refsource_CONFIRM
https://github.com/novuhq/novu/pull/3510
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.