6.1
Moyenne
CVE-2023-22797 An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling…
Description
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| https://github.com/rails/rails | 7.0.4.1 | Pas de correctif indiqué |
Références
- discuss.rubyonrails.org discuss.rubyonrails.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de https://github.com/rails/rails
Les 27 CVE de https://github.com/rails/rails →
CVE-2023-22795
A regular expression based DoS vulnerability in Action…
Non notée
CVE-2022-44566
A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1
7.5
Élevée
CVE-2023-22794
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments
Non notée
CVE-2023-22796
A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1
Non notée