FreeBSDF96044A2-7DF9-414B-9F6B-6E5B85D06C86Rails -- Active Job vulnerability
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
52.2%
Ruby on Rails blog:
Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These
contain the following important security fixes, and it is recommended
that users upgrade as soon as possible
CVE-2018-16476 Broken Access Control vulnerability in Active Job:
Carefully crafted user input can cause Active Job to deserialize it
using GlobalId and allow an attacker to have access to information that
they should not have.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| FreeBSD | any | noarch | rubygem-activejob4 | < 4.2.11 | UNKNOWN |
| FreeBSD | any | noarch | rubygem-activejob5 | < 5.1.6.1 | UNKNOWN |
| FreeBSD | any | noarch | rubygem-activejob50 | < 5.0.7.1 | UNKNOWN |
Related
5 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
0.002 Low
EPSS
Percentile
52.2%