{"schema_version":"1.7.3","id":"BIT-rails-2021-44528","published":"2024-03-06T11:03:24.891Z","modified":"2024-03-06T17:05:41.420Z","aliases":["CVE-2021-44528","GHSA-qphc-hf5q-v8fc"],"details":"A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","affected":[{"package":{"name":"rails","ecosystem":"Bitnami","purl":"pkg:bitnami/rails"},"ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0-rc2"},{"last_affected":"7.0.0-rc2"}]}],"database_specific":{"source":"https://github.com/bitnami/vulndb/tree/main/data/rails/BIT-rails-2021-44528.json"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}],"references":[{"type":"WEB","url":"https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240208-0003/"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5372"}],"database_specific":{"cpes":["cpe:2.3:a:rubyonrails:rails:7.0.0:rc2:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:6.0.4.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:6.1.4.2:*:*:*:*:*:*:*"],"severity":"Medium"}}