Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

🗓️ 05 May 2021 19:49:02Reported by GitHub Advisory DatabaseType

Action Pack vulnerability in `redirect_to` or `polymorphic_url` helper with untrusted user input. Upgrade or apply provided patches

Reporter	Title	Published	Views	Family All 78
AstraLinux	Astra Linux – Vulnerability in Rails	19 Jun 202611:10	–	astralinux
BDU FSTEC	The vulnerability of the `redirect_to` and `polymorphic_url` methods in the Action Pack component of the Ruby on Rails software framework allows for information leakage in error messages, enabling attackers to access confidential data.	2 Nov 202100:00	–	bdu_fstec
IBM Security Bulletins	Security Bulletin: A security vulnerability in Ruby on Rails affects IBM Cloud Pak for Multicloud Management Infrastructure Management	26 Jul 202121:21	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2021-22885).	30 Jul 202105:01	–	ibm
CNNVD	Rails Action Pack 信息泄露漏洞	5 May 202100:00	–	cnnvd
CNVD	Unspecified Vulnerability in Red Hat Satellite 6 (CNVD-2021-44771)	7 May 202100:00	–	cnvd
CVE	CVE-2021-22885	27 May 202111:15	–	cve
Cvelist	CVE-2021-22885	27 May 202111:15	–	cvelist
Debian	[SECURITY] [DLA 2655-1] rails security update	11 May 202120:52	–	debian
Debian	[SECURITY] [DSA 4929-1] rails security update	9 Jun 202121:11	–	debian

Vulners

Node

actionpack_project actionpackRange2.0.0–5.2.4.5rubygems

actionpack_project actionpackRange6.1.0–6.1.3.1rubygems

actionpack_project actionpackRange6.0.0–6.0.3.6rubygems

Source	Link
groups	www.groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-22885
hackerone	www.hackerone.com/reports/1106652
security	www.security.netapp.com/advisory/ntap-20210805-0009/
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22885.yml
github	www.github.com/advisories/GHSA-hjg4-8q5f-x6fm

05 Jul 2023 20:17Current

7.3High risk

Vulners AI Score7.3

CVSS 25

CVSS 3.17.5

EPSS0.04195