CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2023-22797
Medium (6.1). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in actionpack 7.0.4.1.
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- actionpack_project:actionpack
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-9445-4cr6-336r | RubyGems | actionpack | >=7.0.0 <7.0.4.1 | 7.0.4.1 |