This affects the package clearance prior to 2.5.0. The vulnerability can be possible when users are able to set the value of session[:return_to]. If the value used for return_to contains multiple leading slashes (/////example.com) the user ends up being redirected to the external domain that comes after the slashes (example.com).
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
thoughtbot clearance |
Vulmon