CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AI Score
Confidence
Low
In ActiveAdmin versions prior to 2.12.0, a concurrency issue was
found that could allow a malicious actor to be able to access
potentially private data that belongs to another user.
The bug affects the functionality to export data as CSV files, and
was caused by a variable holding the collection to be exported being
shared across threads and not properly synchronized.
The attacker would need access to the same ActiveAdmin application
as the victim, and could exploit the issue by timing their request
immediately before when they know someone else will request a CSV
(e.g. via phishing) or request CSVs frequently and hope someone
else makes a concurrent request.
Versions 2.12.0 and above fixed the problem by completely
removing the shared state.
Vendor | Product | Version | CPE |
---|---|---|---|
ruby | activeadmin | * | cpe:2.3:a:ruby:activeadmin:*:*:*:*:*:*:*:* |