GitHub Advisoryadvisory · RubyGems

GHSA-8877-prq4-9xfw Actionpack Open Redirect Vulnerability

MEDIUM Published 2021-03-02 Modified 2023-07-03 Official page ↗
Aliases
CVE-2021-22881
Ecosystem
RubyGems
Packages
actionpack
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2021-03-02

Affected packages

• RubyGems actionpack: >= 6.0.0, < 6.0.3.5 → fixed in 6.0.3.5 • RubyGems actionpack: >= 6.1.0, < 6.1.2.1 → fixed in 6.1.2.1

Description

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Related

Alias · CVE (1)

  • CVE-2021-22881 The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References