Skip to content
CVE PROGRAM SOURCE RECORD4.0 Medium

CVE-2023-28362

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services whic

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Rails Action Pack

Default version status: unaffected

  • 7.0.5.1 to < 7.0.5.1affected
  • 6.1.7.4 to < 6.1.7.4affected

References