-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from the redirect_to method's lack of validation for illegal characters in HTTP header values prior to the patch. The commit adds ILLEGAL_HEADER_VALUE_REGEX checks and _ensure_url_is_http_header_safe validation, directly addressing this flaw. The CWE-116 mapping confirms improper output escaping, and the vulnerability documentation explicitly implicates redirect_to as the entry point for untrusted data.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| actionpack | rubygems | < 6.1.7.4 | 6.1.7.4 |
| actionpack | rubygems | >= 7.0.0, < 7.0.5.1 | 7.0.5.1 |