CVE-2021-22881

Description

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.

Risk Information

Base Score

6.1

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Score

Exploitation Probability

15.453

Associated Vulnerability

Vulnerability	OS Platform
Vulnerabilities CVE-2021-22881 are fixed in Ruby-actionpack 6.0.3.5	Windows
Vulnerabilities CVE-2021-22881 are fixed in Ruby-actionpack 6.1.2.1	Windows
Vulnerabilities CVE-2021-22881 are fixed in Ruby-actionpack for Linux 6.0.3.5	Linux
Vulnerabilities CVE-2021-22881 are fixed in Ruby-actionpack for Linux 6.1.2.1	Linux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234