CVE-2021-22881CWE-601

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability

published February 11, 2021

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.8th percentile for exploit probability.

CVSS
—
EPSS
87%
Percentile
99.8
In the wild
Unconfirmed
What it is

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.87301 · 99.8th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2021-02-11T16:12Z
EPSS history
Timeline
  • 11 FEB 16:12Z
    The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability
    cvelistv5