Non notée
CVE-2021-22881 The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/rails/rails | Versions non publiées |
Références
- hackerone.com hackerone.com
- discuss.rubyonrails.org discuss.rubyonrails.org
- benjamin-bouchet.com benjamin-bouchet.com
- FEDORA-2021-b571fca1b8 lists.fedoraproject.org
- [oss-security] 20210505 [CVE-2021-22903] Possible Open Redirect Vulnerability in Action Pack www.openwall.com
- [oss-security] 20210819 [CVE-2021-22942] Possible Open Redirect in Host Authorization Middleware www.openwall.com
- [oss-security] 20211214 [CVE-2021-44528] Possible Open Redirect in Host Authorization Middleware www.openwall.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/rails/rails
Les 27 CVE de https://github.com/rails/rails →
CVE-2023-22794
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Non notée
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Non notée
CVE-2023-22792
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1
7.5
Élevée
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
Élevée