CVE-2018-16476CWE-284

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using…

published November 30, 2018

CVSS
—
EPSS
3%
Percentile
86.7
In the wild
Unconfirmed
What it is

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02865 · 86.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2018-11-30T19:00Z
EPSS history
Timeline
  • 30 NOV 19:00Z
    A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using…
    cvelistv5