VDB
CVE-2021-22903
CVE-2021-22903
PUBLISHED
CVSS 6.099999904632568 MEDIUM
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
EPSS 1.23% · 68.8th percentile
Risk Scores
CVSS 3.1
6.099999904632568
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS Score
1.23%
68.8th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:18.04:LTS | rails | 2:4.2.10-0ubuntu4+esm1, 0, 2:4.2.9-2 |
| AWS | config | |
| Ubuntu:Pro:20.04:LTS | rails | 0, 2:5.2.3+dfsg-3ubuntu0.1~esm1, 2:5.2.3+dfsg-3 |
| Ubuntu:25.10 | rails | 2:6.1.7.3+dfsg-7, 0, 2:7.2.2.1+dfsg-7 |
| Ubuntu:24.04:LTS | rails | 0, 2:6.1.7.3+dfsg-2build1, 2:6.1.7.3+dfsg-3 |
| Ubuntu:Pro:16.04:LTS | rails | 2:4.2.5-1, 2:4.1.10-1, 0 |
| Ubuntu:Pro:22.04:LTS | rails | 0, 2:6.1.4.1+dfsg-8ubuntu2+esm1, 2:6.1.4.1+dfsg-8ubuntu2 |
Timeline
- May 5, 2021 CVE Published
- Jun 12, 2021 EPSS Score
- Aug 14, 2021 EPSS Score
- Oct 14, 2021 EPSS Score
- Oct 21, 2021 CVE Updated
- Dec 15, 2021 EPSS Score
- Feb 14, 2022 EPSS Score
- Apr 1, 2022 EPSS Score
- Apr 17, 2022 EPSS Score
- Jun 17, 2022 EPSS Score
- Aug 19, 2022 EPSS Score
- Oct 19, 2022 EPSS Score
References
- https://www.cve.org/CVERecord?id=CVE-2021-22903 third-party-advisory
- https://ubuntu.com/security/CVE-2021-22903 advisory