6.1
Medium
CVE-2023-22797 An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling…
Description
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| https://github.com/rails/rails | 7.0.4.1 | No fix stated |
References
- discuss.rubyonrails.org discuss.rubyonrails.org
Timeline
- Published
- Last modified
Other CVEs of https://github.com/rails/rails
The 27 CVEs of https://github.com/rails/rails →
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Not rated
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
High
CVE-2023-22794
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Not rated
CVE-2023-22796
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1
Not rated