high7.5
CVE-2021-22885
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper w…
Impact
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubyonrails | Rails | from 5.2.0.0 before 5.2.4.6 from 6.0.0.0 before 6.0.3.7 from 6.1.0.0 before 6.1.3.1 |
| Rubyonrails | Actionpack Page-Caching | All versions |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://hackerone.com/reports/1106652
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://www.debian.org/security/2021/dsa-4929
- https://hackerone.com/reports/1106652
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://www.debian.org/security/2021/dsa-4929