Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| 9ef61211d7861093a69fa1fbfc2ba136abd37cd2 through 69e2e898478a1795913b8fda7cb95079228f8fb2 | No fix listed |
| Not specified | 0fccfb9a3097a9c4260c791f1a40b128517e7815 |
Also listed as affected (3)
| |
Description
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.