Terms and Conditions Module vulnerable to Open Redirect
A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.10 and classified as problematic. Affected by this vulnerability is the function returnTo of the file termsandconditions/views.py. The manipulation leads to open redirect. The attack can be launched remotely. Upgrading to version 2.0.11 can address this issue. The name of the patch is 03396a1c2e0af95e12a45c5faef7e47a4b513e1a. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216175.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | django-termsandconditions | < 2.0.11 | 2.0.11 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2022-4589
- https://github.com/cyface/django-termsandconditions/pull/239
- https://github.com/cyface/django-termsandconditions/commit/03396a1c2e0af95e12a45c5faef7e47a4b513e1a
- https://github.com/cyface/django-termsandconditions
- https://github.com/cyface/django-termsandconditions/releases/tag/v2.0.10
- https://github.com/cyface/django-termsandconditions/releases/tag/v2.0.11
- https://vuldb.com/?id.216175
- https://pypi.org/project/django-termsandconditions
- https://github.com/advisories/GHSA-6rmf-cv6p-4h27
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N- Debilidad (CWE)
CWE-601- Plataforma
- Python (PyPI)
- Paquete
django-termsandconditions- Publicada
- 17.12.2022
- Actualizado
- 11.10.2026 13:18
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-805 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-6rmf-cv6p-4h27 - CC BY 4.0
Historial de vulnerabilidades: django-termsandconditions
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
Esta es la única vulnerabilidad conocida de este paquete.
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.