QwikSec

Security Database

CVE

CWE

Training

CVE Database
/

CVE-2021-44528

Back to search

CVE-2021-44528

Published: Jan 7, 2022

Modified: Aug 4, 2024

PUBLISHED

Description

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

VendorProductVersions

n/a

https://github.com/rails/rails

affected
6.1.4.2, 6.0.4.2, 7.0.0.rc2

Weaknesses (CWE)

CWE-601

References

DSA-5372
vendor-advisory

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now