-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from unvalidated use of the 'success_url' parameter in the UpdateView's success URL handling. The fix in commit 79d1395 removed this method entirely, indicating it was the vulnerable code path. The pre-patch code allowed user-supplied URLs to control redirection targets, matching the CWE-601 open redirect pattern. The workflow validation in horizon/workflows/views.py (lines 96-102) shows proper URL validation patterns that were not applied to this endpoint's success_url handling prior to the patch.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| horizon | pip | >= 19.4.0, < 20.2.0 | 20.2.0 |