CVE-2020-28724

An open redirect flaw was found in the WSGI library python-werkzeug. When URL_PATH starts with a double slash, followed by an arbitrary URL without a scheme, python-werkzeug could redirect applications to that arbitrary URL. This flaw allows an attacker to use this technique to redirect victims to phishing websites controlled by an attacker or to use this flaw to chain vulnerabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.