CVE-2022-0869Medium· 6.1▾ TwilightPoC availableOpen Redirect in django-spirit
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 33.6 · likelihood 0.5 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
2.6%
2.6% → 2.6%
Nuclei ×1
django-spirit prior to version 0.12.3 is vulnerable to open redirect. In the /user/login endpoint, it doesn't check the value of the next parameter when the user is logged in and passes it directly to redirect which result to open redirect. This also affects /user/logout, /user/register, /user/login, /user/resend-activation.
django-spirit < 0.12.3Upgrade to a patched release:
django-spirit 0.12.3Field changes observed since this record was first indexed.