{"id":"CVE-2021-22942","published":"2021-10-18T00:00:00Z","modified":"2024-08-03T18:58:26Z","title":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow…","vendor":null,"product":null,"tier":"tail","description":{"text":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01695,"percentile":0.77136,"provenance":"source"},"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/5","tags":["mailing-list"]},{"url":"https://www.debian.org/security/2023/dsa-5372","tags":["vendor-advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20240202-0005/","tags":[]}],"priority":{"score":15.4,"factors":[{"name":"EPSS percentile","points":15.43}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["6.1.4.1, 6.0.4.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.4.1",">=6.1.0, <6.1.4.1"],"patched":["6.0.4.1","6.1.4.1"],"from":["GHSA-2rqw-v265-jf8c"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1517","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-actionpack-cve-2021-22942","packageHistory":[{"cve":"CVE-2021-22902","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22903","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22904","published":"2021-06-11","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2021-22904","to":"CVE-2021-22942","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.7","toFixed":"6.0.4.1","daysApart":129}]}},{"cve":"CVE-2021-22942","published":"2021-10-18","fixed":"6.1.4.1","kev":false},{"cve":"CVE-2021-44528","published":"2022-01-07","fixed":"6.1.4.2","kev":false,"link":{"from":"CVE-2021-22942","to":"CVE-2021-44528","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.4.1","toFixed":"6.0.4.2","daysApart":81},{"kind":"similar","provenance":"machine","score":0.75,"basis":"same package + description similarity"}]}},{"cve":"CVE-2022-23633","published":"2022-02-11","fixed":"7.0.2.2","kev":false},{"cve":"CVE-2022-22577","published":"2022-05-26","fixed":"7.0.2.4","kev":false}],"package":"RubyGems:actionpack"}}