CVE-2021-22881

🗓️ 11 Feb 2021 16:12:34Reported by MendType

mend🔗 www.mend.io

Open redirect in Action Pack Host Authorization middleware via crafted Host headers.

Reporter	Title	Published	Views	Family All 39
FreeBSD	Rails -- multiple vulnerabilities	10 Feb 202100:00	–	freebsd
attackerkb	CVE-2021-22881	11 Feb 202118:15	–	attackerkb
Circl	CVE-2021-22881	11 Feb 202120:42	–	circl
CNNVD	Rails Action Pack Input Validation Error Vulnerability	11 Feb 202100:00	–	cnnvd
CVE	CVE-2021-22881	11 Feb 202116:12	–	cve
Cvelist	CVE-2021-22881	11 Feb 202116:12	–	cvelist
Debian CVE	CVE-2021-22881	11 Feb 202116:12	–	debiancve
EUVD	EUVD-2021-0631	7 Oct 202500:30	–	euvd
Fedora	[SECURITY] Fedora 33 Update: rubygem-actionpack-6.0.3.4-2.fc33	12 Mar 202120:30	–	fedora
Fedora	[SECURITY] Fedora 33 Update: rubygem-activerecord-6.0.3.4-2.fc33	12 Mar 202120:30	–	fedora

Vulners

Node

OR

actionpack_project actionpackRange6.0.0–6.0.3.5

actionpack_project actionpackRange6.1.0–6.1.2.1

Source	Link
openwall	www.openwall.com/lists/oss-security/2021/05/05/2
github	www.github.com/rails/rails
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-22881
openwall	www.openwall.com/lists/oss-security/2021/08/20/1
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.yml
benjamin-bouchet	www.benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/
benjamin-bouchet	www.benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization
github	www.github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.md
github	www.github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3

02 Oct 2026 01:10Current

CVSS 45.3

CVSS 25.8

CVSS 3.16.1

EPSS0.87301

Action Pack Host Authorization open redirect Host header