CVE-2023-22797: Medium severity ruby on rails actionpack vulnerability
An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirectto with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2023-22797?
CVE-2023-22797 is an open redirect vulnerability fixed in Rails 7.0.4.1.
Which versions of Rails are affected by CVE-2023-22797?
Versions 7.0.0 to 7.0.4.1 of Rails are affected by CVE-2023-22797.
What is the severity of CVE-2023-22797?
CVE-2023-22797 has a severity rating of medium.
How can CVE-2023-22797 be fixed?
CVE-2023-22797 can be fixed by updating to Rails version 7.0.4.1 or later.
Where can I find more information about CVE-2023-22797?
You can find more information about CVE-2023-22797 at the following link: https://discuss.rubyonrails.org/t/cve-2023-22799-possible-redos-based-dos-vulnerability-in-globalid/82127