An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
References
Link | Resource |
---|---|
https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127 | Not Applicable |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: hackerone
Published: 2023-02-09T00:00:00
Updated: 2023-02-09T00:00:00
Reserved: 2023-01-06T00:00:00
Link: CVE-2023-22797
JSON object: View
NVD Information
Status : Analyzed
Published: 2023-02-09T20:15:11.550
Modified: 2023-02-21T15:50:11.193
Link: CVE-2023-22797
JSON object: View
Redhat Information
No data.
CWE