CVE-2021-44528

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

References

Affected packages

Git / github.com/rails/rails

Affected ranges

Type

GIT

Repo

https://github.com/rails/rails

Events

Introduced

9ef61211d7861093a69fa1fbfc2ba136abd37cd2

Last affected

69e2e898478a1795913b8fda7cb95079228f8fb2

Fixed

0fccfb9a3097a9c4260c791f1a40b128517e7815

Database specific

Show details

{
    "extracted_events": [
        {
            "introduced": "6.0.4.2"
        },
        {
            "last_affected": "6.0.4.2"
        },
        {
            "introduced": "6.1.4.2"
        },
        {
            "last_affected": "6.1.4.2"
        },
        {
            "introduced": "7.0.0-rc2"
        },
        {
            "last_affected": "7.0.0-rc2"
        }
    ],
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:rubyonrails:rails:6.0.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:rubyonrails:rails:6.1.4.2:*:*:*:*:*:*:*",
        "cpe:2.3:a:rubyonrails:rails:7.0.0:rc2:*:*:*:*:*:*"
    ]
}

Affected versions

6.*

6.0.4.2

6.1.4.2

7.*

7.0.0-rc2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-44528.json"