CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2021-22885 – rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
https://notcve.org/view.php?id=CVE-2021-22885
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input. Una posible vulnerabilidad de divulgación de información y ejecución de método no intecional en Action Pack versiones posteriores a 2.0.0 e incluyéndola, cuando se usa la ayuda "redirect_to" o "polymorphic_url" con la entrada de un usuario no confiable A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the `redirect_to` or `polymorphic_url` helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality. • https://hackerone.com/reports/1106652 https://security.netapp.com/advisory/ntap-20210805-0009 https://www.debian.org/security/2021/dsa-4929 https://access.redhat.com/security/cve/CVE-2021-22885 https://bugzilla.redhat.com/show_bug.cgi?id=1957441 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2021-22881
https://notcve.org/view.php?id=CVE-2021-22881
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website. El middleware de Autorización de Host en Action Pack versiones anteriores a 6.1.2.1, 6.0.3.5 sufre una vulnerabilidad de redireccionamiento abierto. • http://www.openwall.com/lists/oss-security/2021/05/05/2 http://www.openwall.com/lists/oss-security/2021/08/20/1 http://www.openwall.com/lists/oss-security/2021/12/14/5 https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 https://hackerone.com/reports/1047447 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 2CVE-2021-22880
https://notcve.org/view.php?id=CVE-2021-22880
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input. El adaptador PostgreSQL en Active Record versiones anteriores a 6.1.2.1, 6.0.3.5, 5.2.4.5, sufre una vulnerabilidad de denegación de servicio de expresión regular (REDoS). Una entrada cuidadosamente diseñada puede causar que la comprobación de la entrada en el tipo "money" del adaptador de PostgreSQL en Active Record pase demasiado tiempo en una expresión regular, resultando en la posibilidad de un ataque DoS. • https://github.com/halkichi0308/CVE-2021-22880 https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129 https://hackerone.com/reports/1023899 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3 https://security.netapp.com/advisory/ntap-20210805-0009 https://www.debian.org/ • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8264
https://notcve.org/view.php?id=CVE-2020-8264
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. En actionpack gem versiones posteriores a 6.0.0 incluyéndola, se presenta una posible vulnerabilidad de tipo XSS cuando una aplicación se ejecuta en modo development permitiendo a un atacante enviar o insertar (en otra página) una URL especialmente diseñada que puede permitir al atacante ejecutar JavaScript en el contexto de la aplicación local. Esta vulnerabilidad se encuentra en el middleware de Excepciones Accionables • https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ https://hackerone.com/reports/904059 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 3EXPL: 1CVE-2020-8166 – rubygem-actionpack: ability to forge per-form CSRF tokens given a global CSRF token
https://notcve.org/view.php?id=CVE-2020-8166
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token. Se presenta una vulnerabilidad de falsificación CSRF en rails versiones anteriores a 5.2.5, rails versiones anteriores a 6.0.4 que hace posible para un atacante, dado un token CSRF global como el presente en la etiqueta meta de authenticity_token, forjar un token CSRF per-form A flaw was found in rubygem-actionpack. Forgery of a per-form CSRF token is possible allowing for any action to take place for that session. The highest threat from this vulnerability is to data integrity. • https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw https://hackerone.com/reports/732415 https://www.debian.org/security/2020/dsa-4766 https://access.redhat.com/security/cve/CVE-2020-8166 https://bugzilla.redhat.com/show_bug.cgi?id=1843152 • CWE-352: Cross-Site Request Forgery (CSRF) •