{"schema_version":"1.9.0","id":"CVE-2021-44528","published":"2022-01-10T14:10:26.117Z","modified":"2026-09-09T08:15:08.256882Z","aliases":["BIT-rails-2021-44528","GHSA-qphc-hf5q-v8fc"],"related":["openSUSE-SU-2024:11821-1"],"details":"A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a \"X-Forwarded-Host\" headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rails/rails","events":[{"introduced":"9ef61211d7861093a69fa1fbfc2ba136abd37cd2"},{"last_affected":"69e2e898478a1795913b8fda7cb95079228f8fb2"},{"fixed":"0fccfb9a3097a9c4260c791f1a40b128517e7815"}],"database_specific":{"cpe":["cpe:2.3:a:rubyonrails:rails:6.0.4.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:6.1.4.2:*:*:*:*:*:*:*","cpe:2.3:a:rubyonrails:rails:7.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"6.0.4.2"},{"last_affected":"6.0.4.2"},{"introduced":"6.1.4.2"},{"last_affected":"6.1.4.2"},{"introduced":"7.0.0-rc2"},{"last_affected":"7.0.0-rc2"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["6.0.4.2","6.1.4.2","7.0.0-rc2"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-44528.json"}}],"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20240208-0003/"},{"type":"ADVISORY","url":"https://www.debian.org/security/2023/dsa-5372"},{"type":"FIX","url":"https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}