Description (CNA)
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / https://github.com/rails/rails | affected 6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6 |
CWE
CWE-209
References
- https://hackerone.com/reports/1106652
- https://www.debian.org/security/2021/dsa-4929
- https://security.netapp.com/advisory/ntap-20210805-0009/
ADP enrichment
No English description supplied.