CVE-2026-54770

{"id": "CVE-2026-54770", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54770", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-25T15:03:54.011941Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "Pylons", "product": "webob", "versions": [{"status": "affected", "version": "< 1.8.11"}]}]}], "published": "2026-08-20T17:18:18.277", "references": [{"url": "https://github.com/Pylons/webob/commit/ff89560643fb252751b4db8806a283b5377f1f07", "source": "security-advisories@github.com"}, {"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g", "source": "security-advisories@github.com"}, {"url": "https://github.com/Pylons/webob/tree/1.8.11", "source": "security-advisories@github.com"}, {"url": "https://github.com/Pylons/webob/security/advisories/GHSA-6hx8-3wjj-gr8g", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-601"}]}], "descriptions": [{"lang": "en", "value": "WebOb provides objects for HTTP requests and responses. Prior to 1.8.11, Response._make_location_absolute() in src/webob/response.py checks a Location value for a URI scheme or leading double slash before urllib.parse.urljoin() strips leading C0 control characters and spaces. An attacker-controlled value such as a space followed by a protocol-relative or absolute URL can therefore bypass SCHEME_RE and startswith(\"//\") checks and be normalized to an off-host redirect. Request.relative_url() and webob.exc._HTTPMove subclasses, including HTTPFound, are also affected because they use the same unsafe URL joining behavior or bypass the earlier normalization path. An unauthenticated attacker who can influence an application's redirect target can send users to an attacker-controlled host for phishing or OAuth and SSO token theft, but exploitation requires the user to follow the redirect. This issue is fixed in version 1.8.11."}, {"lang": "es", "value": "WebOb proporciona objetos para solicitudes y respuestas HTTP. Antes de la versi\u00f3n 1.8.11, Response._make_location_absolute() en src/webob/response.py verifica un valor de Location en busca de un esquema URI o una doble barra inicial antes de que urllib.parse.urljoin() elimine los caracteres de control C0 iniciales y los espacios. Un valor controlado por el atacante, como un espacio seguido de una URL relativa al protocolo o absoluta, puede, por lo tanto, eludir las comprobaciones de SCHEME_RE y startswith(\u201c//\u201d) y ser normalizado a una redirecci\u00f3n fuera del host. Request.relative_url() y las subclases de webob.exc._HTTPMove, incluyendo HTTPFound, tambi\u00e9n se ven afectadas porque utilizan el mismo comportamiento inseguro de uni\u00f3n de URL o eluden la ruta de normalizaci\u00f3n anterior. Un atacante no autenticado que puede influir en el objetivo de redirecci\u00f3n de una aplicaci\u00f3n puede enviar a los usuarios a un host controlado por el atacante para phishing o robo de tokens de OAuth y SSO, pero la explotaci\u00f3n requiere que el usuario siga la redirecci\u00f3n. Este problema se ha solucionado en la versi\u00f3n 1.8.11."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "security-advisories@github.com"}