Security readout for executives and security teams
Plain-English summary
Read the Docs before 3.5.1 could allow some user-defined redirects to send visitors to an unintended external site. This is mainly a trust and phishing risk: attackers could abuse a trusted documentation domain to mislead users. The sources do not provide CVSS, CWE, or evidence of active exploitation.
Executive priority
Treat as a moderate web trust issue. It should be remediated in routine security maintenance, with higher priority for documentation portals used by customers or employees.
Technical view
CVE-2019-13175 is an open redirect in Read the Docs before 3.5.1 when certain user-defined redirects are present. The issue affects private Read the Docs instances as well as public readthedocs.org websites. Available sources do not describe affected configurations in detail or provide exploit mechanics.
Likely exposure
Exposure is most likely where Read the Docs versions before 3.5.1 are used and projects define redirects. Private deployments should be checked directly.
Exploitation context
The provided source bundle does not show KEV listing or cited evidence of active exploitation. Open redirects are commonly useful for phishing and trust abuse, not direct host compromise.
Researcher notes
The public record is sparse: no CVSS vector, CWE mapping, or detailed configuration criteria are included in the bundle. Keep validation focused on version, redirect usage, and vendor advisory details.
Mitigation direction
- Upgrade Read the Docs to version 3.5.1 or later.
- Review the GitHub advisory for vendor-confirmed guidance.
- Audit user-defined redirects for unexpected external destinations.
- Remove or constrain risky redirects until upgraded.
- Prioritize private instances exposed to untrusted users.
Validation and detection
- Inventory Read the Docs versions across public and private deployments.
- Identify projects using user-defined redirects.
- Confirm upgraded instances report version 3.5.1 or later.
- Review redirect configurations for external or ambiguous destinations.
- Check web logs for unusual redirect-heavy traffic patterns.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-13175 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/readthedocs/readthedocs.org/security/advisories/GHSA-2mw9-4c46-qrcvCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.