CVE-2021-22881

Katalog CVE

CVSS 6.1 · Medium EPSS 87,3%

Kerentanan URL Redirection to Untrusted Site ('Open Redirect') pada rubyonrails rails, fedoraproject fedora. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Rincian

Terbit di NVD

11 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

EPSS (30 hari)

87,3% peluang dieksploitasi; lebih tinggi dari 99,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 mitigasi · patch · advisory vendor
• http://www.openwall.com/lists/oss-security/2021/12/14/5 exploit · mailing list · patch
• https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/ patch · advisory pihak ketiga
• https://hackerone.com/reports/1047447 exploit · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/05/05/2 mailing list · mitigasi · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2021/08/20/1 mailing list · mitigasi · advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3...