{
  "affected": [
    {
      "ranges": [
        {
          "database_specific": {
            "extracted_events": [
              {
                "introduced": "7.0.5.1"
              },
              {
                "last_affected": "7.0.5.1"
              },
              {
                "introduced": "6.1.7.4"
              },
              {
                "last_affected": "6.1.7.4"
              }
            ],
            "source": [
              "AFFECTED_FIELD",
              "REFERENCES"
            ]
          },
          "events": [
            {
              "introduced": "cdd14ce1f5196e4bd98df42f89a1cd36ba9d4bee"
            },
            {
              "fixed": "1c3f93d1e90a3475f9ae2377ead25ccf11f71441"
            },
            {
              "fixed": "69e37c84e3f77d75566424c7d0015172d6a6fac5"
            }
          ],
          "repo": "https://github.com/rails/rails",
          "type": "GIT"
        }
      ],
      "versions": [
        "6.1.7.4",
        "7.0.5.1"
      ]
    }
  ],
  "aliases": [
    "GHSA-4g8v-vg43-wpgf"
  ],
  "database_specific": {
    "cna_assigner": "hackerone",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28362.json"
  },
  "details": "The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.",
  "id": "CVE-2023-28362",
  "modified": "2026-09-09T03:30:21.035320824Z",
  "published": "2025-01-09T00:33:47.730Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/28xxx/CVE-2023-28362.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-4g8v-vg43-wpgf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28362"
    },
    {
      "type": "ADVISORY",
      "url": "https://security.netapp.com/advisory/ntap-20250502-0009/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441"
    },
    {
      "type": "FIX",
      "url": "https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac5"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}