{"id":"CVE-2021-22885","published":"2021-05-27T11:15:32Z","modified":"2024-08-03T18:58:24Z","title":"A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the…","vendor":null,"product":null,"tier":"tail","description":{"text":"A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04082,"percentile":0.90672,"provenance":"source"},"cwes":[{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information"}],"references":[{"url":"https://hackerone.com/reports/1106652","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2021/dsa-4929","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"https://security.netapp.com/advisory/ntap-20210805-0009/","tags":["x_refsource_CONFIRM"]}],"priority":{"score":18.1,"factors":[{"name":"EPSS percentile","points":18.13}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.7",">=6.1.0, <6.1.3.2",">=5.2.5, <5.2.6",">=2.0.0, <5.2.4.6"],"patched":["6.0.3.7","6.1.3.2","5.2.6","5.2.4.6"],"from":["GHSA-hjg4-8q5f-x6fm"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-1104","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2021-22885","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"5.2.4.3","toFixed":"5.2.4.6","daysApart":329}]}},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false},{"cve":"CVE-2020-8264","published":"2021-01-06","fixed":"6.0.3.4","kev":false},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false,"link":{"from":"CVE-2021-22881","to":"CVE-2021-22885","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.5","toFixed":"6.0.3.7","daysApart":105}]}},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22902","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22903","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22904","published":"2021-06-11","fixed":"6.1.3.2","kev":false}],"package":"RubyGems:actionpack"}}