Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2018-16476

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give th

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n/a https://github.com/rails/rails

  • 4.2.0 up to and before 4.2.11affected
  • 4.2.0 up to and before 5.0.7.1affected
  • 4.2.0 up to and before 5.1.6.1affected
  • 4.2.0 up to and before 5.2.1.1affected

References