Severity
- CVSS 3.x
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/rails/rails ↗ | |
| cdd14ce1f5196e4bd98df42f89a1cd36ba9d4bee to before 1c3f93d1e90a3475f9ae2377ead25ccf11f71441 | 1c3f93d1e90a3475f9ae2377ead25ccf11f71441 |
| Not specified | 69e37c84e3f77d75566424c7d0015172d6a6fac5 |
Also listed as affected (2)
| |
Description
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
References
- Webdiscuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132 ↗
- Advisorygithub.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28362.json ↗
- Advisorygithub.com/advisories/GHSA-4g8v-vg43-wpgf ↗
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-28362 ↗
- Advisorysecurity.netapp.com/advisory/ntap-20250502-0009/ ↗
- Fixgithub.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441 ↗
- Fixgithub.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5 ↗