CVE-2023-28362

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value

Medium · published January 9, 2025

CVSS v3.1
4.0
EPSS
0%
Percentile
25.2
In the wild
Unconfirmed
What it is

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

The record
Technical detail
CVSS v3.1
4.0 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00333 · 25.2th percentile
Published
2025-01-09T00:33Z
EPSS history
Timeline
  • 09 JAN 00:33Z
    The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value
    cvelistv5