CVE-2021-32645
Description
Tenancy multi-tenant is an open source multi-domain controller for the Laravel web framework. In some situations, it is possible to have open redirects where users can be redirected from your site to any other site using a specially crafted URL. This is only the case for installations where the default Hostname Identification is used and the environment uses tenants that have `force_https` set to `true` (default: `false`). Version 5.7.2 contains the relevant patches to fix this bug. Stripping the URL from special characters to prevent specially crafted URL's from being redirected to. As a work around users can set the `force_https` to every tenant to `false`, however this may degrade connection security.
How to fix
- tenancy multi-tenant5.7.2 or later
- hyn/multi-tenant5.7.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tenancy multi-tenant | 5.6.0 ≤ v < 5.7.2 | 5.7.2 |
| hyn/multi-tenantPackagist | 5.6.0 ≤ v < 5.7.2 | 5.7.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.