Lucene search
GoogleOSV:CVE-2021-22903HistoryJun 11, 2021 - 4:15 p.m.
CVE-2021-22903
2021-06-1116:15:11
Google
osv.dev
5
actionpack
ruby gem
open redirect
vulnerability
host headers
middleware
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.
Related
osv
osv
Possible Open Redirect Vulnerability in Action Pack
2021-05-05 19:48:29
CVE-2021-22881
2021-02-11 18:15:17
Actionpack Open Redirect Vulnerability
2021-03-02 03:44:17
ubuntucve
ubuntucve
CVE-2021-22903
2021-06-11 00:00:00
CVE-2021-22881
2021-02-11 00:00:00
prion
prion
Open redirect
2021-06-11 16:15:00
Open redirect
2021-02-11 18:15:00
debiancve
debiancve
CVE-2021-22903
2021-06-11 16:15:11
CVE-2021-22881
2021-02-11 18:15:17
cve
cve
CVE-2021-22903
2021-06-11 16:15:11
CVE-2021-22881
2021-02-11 18:15:17
rubygems
rubygems
Possible Open Redirect Vulnerability in Action Pack
2021-05-04 21:00:00
Possible Open Redirect in Host Authorization Middleware
2021-02-09 21:00:00
Possible Open Redirect in Host Authorization Middleware
2021-08-18 21:00:00
nvd
nvd
CVE-2021-22903
2021-06-11 16:15:11
CVE-2021-22881
2021-02-11 18:15:17
github
github
Possible Open Redirect Vulnerability in Action Pack
2021-05-05 19:48:29
Actionpack Open Redirect Vulnerability
2021-03-02 03:44:17
Open Redirect in ActionPack
2021-08-26 20:36:51
cvelist
cvelist
CVE-2021-22903
2021-06-11 15:49:38
CVE-2021-22881
2021-02-11 16:12:34
veracode
veracode
Open Redirection
2021-05-06 06:01:02
Open Redirect
2021-02-15 01:22:32
Open Redirection
2021-02-15 03:48:29
redhatcve
redhatcve
CVE-2021-22903
2021-05-05 19:15:48
CVE-2021-22881
2021-02-18 15:38:23
hackerone
hackerone
fedora
fedora
[SECURITY] Fedora 33 Update: rubygem-activerecord-6.0.3.4-2.fc33
2021-03-12 20:30:33
[SECURITY] Fedora 33 Update: rubygem-actionpack-6.0.3.4-2.fc33
2021-03-12 20:30:33
freebsd
freebsd
Rails -- multiple vulnerabilities
2021-02-10 00:00:00
Rails -- multiple vulnerabilities
2021-05-05 00:00:00
openvas
openvas
Fedora: Security Advisory for rubygem-actionpack (FEDORA-2021-b571fca1b8)
2021-03-13 00:00:00
Fedora: Security Advisory for rubygem-activerecord (FEDORA-2021-b571fca1b8)
2021-03-13 00:00:00
Discourse 2.7.0.beta9 Security Update
2021-05-20 00:00:00
nessus
nessus