CVE-2020-12283

Sourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/redirect.go, such as for the //foo//example.com substring.

• CWE-601

• https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1Release Notes, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/pull/10167Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraphExploit, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/blob/master/CHANGELOG.mdRelease Notes, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/commit/c0f48172e815c7f66471a38f0a06d1fc32a77a64Patch, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/compare/v3.15.0...v3.15.1Release Notes, Third Party Advisory
• https://github.com/sourcegraph/sourcegraph/pull/10167Patch, Third Party Advisory
• https://securitylab.github.com/advisories/GHSL-2020-085-sourcegraphExploit, Third Party Advisory

Published

Apr 30, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-12278An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
• CVE-2020-12279An issue was discovered in libgit2 before 0.28.4 and 0.9x be…9.8
• CVE-2020-1228<p>A denial of service vulnerability exists in Windows DNS w…7.5
• CVE-2020-12280iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12281iSmartgate PRO 1.5.9 is vulnerable to CSRF that allows remot…6.5
• CVE-2020-12282iSmartgate PRO 1.5.9 is vulnerable to CSRF via the busca par…8.8
• CVE-2020-12284cbs_jpeg_split_fragment in libavcodec/cbs_jpeg.c in FFmpeg 4…9.8
• CVE-2020-12286In Octopus Deploy before 2019.12.9 and 2020 before 2020.1.12…4.3
• CVE-2020-12287Incorrect permissions in the Intel(R) Distribution of OpenVI…7.8
• CVE-2020-12288Protection mechanism failure in some Intel(R) Thunderbolt(TM…5.5
• CVE-2020-12289Out-of-bounds write in some Intel(R) Thunderbolt(TM) control…5.5
• CVE-2020-1229A security feature bypass vulnerability exists in Microsoft …4.3