PT-2021-15288 · Unknown+1 · Action Pack+1

Published 2021-08-26 · Updated 2024-06-15 · CVE-2021-22942

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Action Pack versions 6.0.0 and later

Description A possible open redirect vulnerability in the Host Authorization middleware could allow attackers to redirect users to a malicious website.

Recommendations For Action Pack versions 6.0.0 and later, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the Host Authorization middleware until a patch is available.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-2693

CVE-2021-22942

DSA-5372-1

GHSA-2RQW-V265-JF8C

OPENSUSE-SU-2024:11821-1

Affected Products

Alt Linux

Action Pack

References · 34

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22942.yml · Exploit
• https://debian.org/security/2023/dsa-5372 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11821-1 · Vendor Advisory
• https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22942 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-22942 · Security Note
• https://osv.dev/vulnerability/CVE-2021-22942 · Vendor Advisory
• http://openwall.com/lists/oss-security/2021/12/14/5 · Patch
• https://osv.dev/vulnerability/DSA-5372-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-22942 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22942 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22942 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22942 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2rqw-v265-jf8c · Vendor Advisory
• https://github.com/rails/rails · Note