Vulnerability advisory

CVE-2021-22885

Published May 27, 2021Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/rails/rails ↗
All commits before 26126839058bad41120b5d74f3cc06b93baa987e	`26126839058bad41120b5d74f3cc06b93baa987e`
Not specified	`c04aff675d4cd3e8a54e0008dbfca10a8832a414`
Not specified	`85c6823b77b60f2a3a6a25d7a1013032e8c580ef`
Also listed as affected (62) `v5.2.4.5` `v6.0.3.6` `v6.1.3` `v6.0.3.5` `v6.1.2` `v6.0.3.4` `v5.2.4.4` `v6.1.1` `v6.1.0` `v6.1.0.rc2` `v6.1.0.rc1` `v6.0.3.3` `v5.2.4.3` `v6.0.3.2` `v6.0.3.1` `v6.0.3` `v5.2.4.2` `v6.0.3.rc1` `v5.2.4.1` `v5.2.4` `v5.2.4.rc1` `v6.0.0` `v6.0.0.rc1` `v6.0.0.beta2` `v6.0.0.beta1` `v5.2.1.rc1` `v5.2.0.rc1` `v5.1.0.beta1` `v5.0.0.beta4` `v5.0.0.beta2` `v5.0.0.beta1` `v4.2.0.beta1` `v4.0.0.rc1` `v4.0.0.beta1` `v3.2.0.rc1` `v3.1.0.rc1` `v3.1.0.beta1` `v3.0.0.beta3` `v3.0.0.beta.3` `v2.0.1` `v2.0.0` `v2.0.0_RC2` `v2.0.0_RC1` `v2.0.0_PR` `v1.1.1` `v1.1.0` `v1.1.0_RC1` `v0.14.3` `v0.14.1` `v0.13.1` `v0.13.0` `v0.12.0` `v0.11.1` `v0.11.0` `v0.10.1` `v0.10.0` `v0.9.5` `v0.9.4.1` `v0.9.4` `v0.9.3` `v0.9.2` `v0.9.1`

Description

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirect_to or polymorphic_urlhelper with untrusted user input.

References

Advisorysecurity.netapp.com/advisory/ntap-20210805-0009/ ↗
Advisorywww.debian.org/security/2021/dsa-4929 ↗
EVIDENCEhackerone.com/reports/1106652 ↗