CVE-2021-23435

This affects the package clearance before 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (http://example.com).

• CWE-601

• https://github.com/thoughtbot/clearance/pull/945Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-RUBY-CLEARANCE-1577284Third Party Advisory
• https://github.com/thoughtbot/clearance/pull/945Patch, Third Party Advisory
• https://snyk.io/vuln/SNYK-RUBY-CLEARANCE-1577284Third Party Advisory

Published

Sep 12, 2021

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-2343Vulnerability in the Oracle Workflow product of Oracle E-Bus…4.3
• CVE-2021-23430All versions of package startserver are vulnerable to Direct…7.5
• CVE-2021-23431The package joplin before 2.3.2 are vulnerable to Cross-site…8.8
• CVE-2021-23432This affects all versions of package mootools. This is due t…9.8
• CVE-2021-23433The package algoliasearch-helper before 3.6.2 are vulnerable…9.8
• CVE-2021-23434This affects the package object-path before 0.11.6. A type c…8.6
• CVE-2021-23436This affects the package immer before 9.0.6. A type confusio…9.8
• CVE-2021-23437The package pillow 5.2.0 and before 8.3.2 are vulnerable to …7.5
• CVE-2021-23438This affects the package mpath before 0.8.4. A type confusio…9.8
• CVE-2021-23439This affects the package file-upload-with-preview before 4.2…6.1
• CVE-2021-2344Vulnerability in the Oracle Coherence product of Oracle Fusi…7.5
• CVE-2021-23440This affects the package set-value before <2.0.1, >=3.0.0 <4…9.8