UBUNTU-CVE-2021-44528
See a problem?- Source
- https://ubuntu.com/security/notices/UBUNTU-CVE-2021-44528
- Import Source
- https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-44528.json
- JSON Data
- https://api.osv.dev/v1/vulns/UBUNTU-CVE-2021-44528
- Related
- Published
- 2022-01-10T14:10:00Z
- Modified
- 2022-01-10T14:10:00Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
- References
-
- https://ubuntu.com/security/CVE-2021-44528
- https://www.openwall.com/lists/oss-security/2021/12/14/5
- https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815
- https://github.com/rails/rails/commit/aecba3c301b80e9d5a63c30ea1b287bceaf2c107
- https://github.com/rails/rails/commit/fd6a64fef1d0f7f40a8d4b046da882e83163299c
- https://www.cve.org/CVERecord?id=CVE-2021-44528