CVE-2023-22797

2023-02-0900:00:00

CWE-601

hackerone

www.cve.org

rails

open redirect

vulnerability

fix

untrusted input

bypass

6.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.4%

JSON

An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "https://github.com/rails/rails",
    "versions": [
      {
        "version": "7.0.4.1",
        "status": "affected"
      }
    ]
  }
]