Cloned from https://bugzilla.redhat.com/show_bug.cgi?id=2228860

An open redirect weakness was found in Foreman's links_controller.rb. When using the root_url parameter, it is possible to redirect the user to an attacker controlled URL.

On a Foreman/Katello box, this can be triggered as simply as
https://foreman.example.com/links/manual?root_url=https://3w.tf

You can also use the plugin doc handler:
https://foreman.example.com/links/plugin_manual/?root_url=https://3w.tf&name=/