CVE-2023-28362 Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
MediumCVSS 4.0
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems actionpack(RubyGems) | < 6.1.7.4 | 6.1.7.4 |
| rubygems actionpack(RubyGems) | = 0.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 0.9.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.10.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.10.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.11.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.12.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.13.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.2.0 | No fix listed |
Show 175 more
| rubygems actionpack(RubyGems) | = 1.3.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.3.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.4.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.5.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.6.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.7.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.8.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 1.9.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.8.pre1 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 2.3.9.pre | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.beta4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.12.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.19 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.20 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.6.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.7.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.8.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.0.9.rc5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.beta1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.0.rc8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.2.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.5.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.1.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.13.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.14.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.15.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.16 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.17 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.18 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.19 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.2.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.20 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.21 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22.2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.22.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.3.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.4 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.4.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.5 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.6 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.7 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.7.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.8.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 3.2.9.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.0 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.0.beta1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.0.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.0.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc3 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.1.rc4 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.10.rc2 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.11 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.11.1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.12 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.13 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.13.rc1 | No fix listed |
| rubygems actionpack(RubyGems) | = 4.0.2 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- github.com patch
- github.com patch
- discuss.rubyonrails.org
- github.com product
- github.com exploit
- security.netapp.com
- security-tracker.debian.org vendor-advisory
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org