CVE-2020-12666

mediumpriority · track · 24EPSS 0.014 · 72 %ileDEEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.41% (72nd) EPSS
CVSS 5.8 · medium
Is it mine?
8 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · cert_bund

EPSS · scored 2026-10-23

macaron before 1.3.7 has an open redirect in the static handler, as demonstrated by the http://127.0.0.1:4000//example.com/ URL.

01

cvss

Technical severity, 0–10. One row per scoring source.

6.1
010

base score 0–10 · higher = more severe · hover a vector to decode

v2.05.8mediumAV:N/AC:M/Au:N/C:P/I:P/A:Nprimary · NVD / NIST USexploitability 8.6 · impact 4.9
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 2.7
v3.16.1mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:Nsecondary · OSV
v3.15.6mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)
02

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-601USprimaryCWE-601US
03

affected products (8)

Products and version ranges known to be affected.

04

advisories (3)

Vendor and ecosystem advisories describing this.

  • WID-SEC-W-2023-2981Red Hat OpenShift: Mehrere SchwachstellenDeutsch2020-08-06csaf · cert_bundDE

    Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial of Service zu verursachen oder weitere nicht definierte Auswirkungen zu erzielen.

  • GHSA-733f-44f3-3frwgopkg.in/macaron.v1 Open Redirect vulnerability2021-05-18ghsa · osvUS

    macaron before 1.3.7 has an open redirect in the static handler. Due to improper request santization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.

  • GO-2020-0039Open redirect in gopkg.in/macaron.v12021-04-14vendor · osvUS

    Due to improper request sanitization, a specifically crafted URL can cause the static file handler to redirect to an attacker chosen URL, allowing for open redirect attacks.

05

also known as (5)

Other names and identifiers for this entity.

06

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvcert_bundnvdNVDCVE.orgMITRE
published 2020-05-05modified 2026-06-17
08

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan