CVE-2021-44528CWE-601

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain…

published January 7, 2022

CVSS
—
EPSS
4%
Percentile
90.9
In the wild
Unconfirmed
What it is

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.04182 · 90.9th percentile
Weakness
CWE-601 · URL Redirection to Untrusted Site ('Open Redirect')
Published
2022-01-07T00:00Z
EPSS history
Timeline
  • 07 JAN 00:00Z
    A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain…
    cvelistv5