Lucene search

PRIOn knowledge basePRION:CVE-2021-22904

HistoryJun 11, 2021 - 4:15 p.m.

Authentication flaw

2021-06-1116:15:00

PRIOn knowledge base

www.prio-n.com

7.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

60.8%

JSON

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication.

CPENameOperatorVersion
railsge6.1.0
railslt6.1.3.2
railsge6.0.0
railslt6.0.3.7
railslt5.2.4.6
railsge5.2.5
railslt5.2.6

Name	Operator	Version
rails	ge	6.1.0
rails	lt	6.1.3.2
rails	ge	6.0.0
rails	lt	6.0.3.7
rails	lt	5.2.4.6
rails	ge	5.2.5
rails	lt	5.2.6

References

discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869

hackerone.com/reports/1101125

security.netapp.com/advisory/ntap-20210805-0009/