Every CVE Search/ Get API key

CVE-2023-28362

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

4.0 MediumFix available

CVE-2023-28362 is a medium vulnerability (CVSS 4.0) in Rails Action Pack, published June 29, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in actionpack 6.1.7.4.

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
Low
Availability
None

Exploit likelihood

0.33%Up 0.3 points since Jan 9, 2025
90%50%10%1%

What each source reports

CVE List Score used 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
CVE-2023-28362
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
EUVDEUVD-2023-1687 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
EUVD-2023-1687
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-4g8v-vg43-wpgf 4.0

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4

Impact

This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).

Releases

The FIXED releases are available at the normal locations.

Workarounds

Avoid providing user supplied URLs with arbitrary schemes to the redirect_to method.

Record
GHSA-4g8v-vg43-wpgf
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
NVD 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
CVE-2023-28362
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSV 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
CVE-2023-28362
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2023-28362 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
DEBIAN-CVE-2023-28362
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-4g8v-vg43-wpgf 4.0

Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4

Impact

This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).

Releases

The FIXED releases are available at the normal locations.

Workarounds

Avoid providing user supplied URLs with arbitrary schemes to the redirect_to method.

Record
GHSA-4g8v-vg43-wpgf
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Weakness
CWE-116
Updated
2026-11-02
OSVOESA-2024-2465 4.7

rubygem-actionpack security update

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser.

Security Fix(es):

A Cross-site Scripting (XSS) vulnerability was found in Actionpack due to improper sanitization of user-supplied values. This allows provided values to contain characters that are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned location header.(CVE-2023-28362)

Record
OESA-2024-2465
CVSS 3.1
4.7 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2023:7851 6.7

Red Hat Security Advisory: Satellite 6.14.1 Async Security Update

Record
RHSA-2023:7851
CVSS 3.1
6.7 MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2023-28362 4.0

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Record
UBUNTU-CVE-2023-28362
CVSS 3.1
4.0 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Updated
2026-11-02
OSVSUSE-SU-2023:3229-1 No score

Security update for rubygem-actionpack-5_1

This update for rubygem-actionpack-5_1 fixes the following issues:

  • CVE-2023-28362: Fixed possible XSS via User Supplied Values to redirect_to (bsc#1213312).
Record
SUSE-SU-2023:3229-1
Updated
2026-11-02
OSVSUSE-SU-2023:3255-1 No score

Security update for rubygem-actionpack-4_2

This update for rubygem-actionpack-4_2 fixes the following issues:

  • CVE-2023-28362: Fixed XSS via User Supplied Values to redirect_to (bsc#1213312).
Record
SUSE-SU-2023:3255-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
actionpack
RubyGems
 before 6.1.7.4
6.1.7.4
actionpack
RubyGems
 7.0.0 up to 7.0.5.1
7.0.5.1
rails
Debian:12
 before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions
2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13
Show 10 moreShow less
2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9
2:6.1.7.10+dfsg-1~deb12u1
rails
Debian:13
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:14
 before 2:7.2.2.1+dfsg-1
2:7.2.2.1+dfsg-1
rails
Debian:11
 before 2:6.0.3.7+dfsg-2+deb11u3, plus listed versions
2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u2
2:6.0.3.7+dfsg-2+deb11u3
actionpack
RubyGems
 before 6.1.7.4, plus listed versions
0.9.00.9.51.0.01.0.11.1.0
Show 45 moreShow less
1.10.11.10.21.11.01.11.11.11.21.12.01.12.11.12.21.12.31.12.41.12.51.13.01.13.11.13.21.13.31.13.41.13.51.13.61.2.01.3.01.3.11.4.01.5.01.5.11.6.01.7.01.8.01.8.11.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.15
6.1.7.4
actionpack
RubyGems
 7.0.0 up to 7.0.5.1, plus listed versions
7.0.17.0.27.0.2.17.0.2.27.0.2.3
Show 8 moreShow less
7.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.5
7.0.5.1
rubygem-actionpack
openEuler:22.03-LTS-SP1
 before 6.1.4.1-7.oe2203sp1
6.1.4.1-7.oe2203sp1
foreman
Red Hat:satellite_capsule:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
Show 106 moreShow less
Affected packages
PackageAffectedFixed
foreman-debug
Red Hat:satellite_capsule:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-installer
Red Hat:satellite_capsule:6.14::el8
 before 1:3.7.0.5-1.el8sat
1:3.7.0.5-1.el8sat
foreman-installer-katello
Red Hat:satellite_capsule:6.14::el8
 before 1:3.7.0.5-1.el8sat
1:3.7.0.5-1.el8sat
foreman
Red Hat:satellite_utils:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-cli
Red Hat:satellite_utils:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-cli
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-debug
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-ec2
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-installer
Red Hat:satellite:6.14::el8
 before 1:3.7.0.5-1.el8sat
1:3.7.0.5-1.el8sat
foreman-installer-katello
Red Hat:satellite:6.14::el8
 before 1:3.7.0.5-1.el8sat
1:3.7.0.5-1.el8sat
foreman-journald
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-libvirt
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-openstack
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-ovirt
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-postgresql
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-redis
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-service
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-telemetry
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
foreman-vmware
Red Hat:satellite:6.14::el8
 before 0:3.7.0.10-1.el8sat
0:3.7.0.10-1.el8sat
rubygem-actionpack
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
python-gitpython
Red Hat:satellite_capsule:6.14::el8
 before 0:3.1.40-0.1.el8pc
0:3.1.40-0.1.el8pc
python39-gitpython
Red Hat:satellite_capsule:6.14::el8
 before 0:3.1.40-0.1.el8pc
0:3.1.40-0.1.el8pc
python-gitpython
Red Hat:satellite:6.14::el8
 before 0:3.1.40-0.1.el8pc
0:3.1.40-0.1.el8pc
python39-gitpython
Red Hat:satellite:6.14::el8
 before 0:3.1.40-0.1.el8pc
0:3.1.40-0.1.el8pc
createrepo_c
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-debuginfo
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-debugsource
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-libs
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-libs-debuginfo
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
pulpcore-selinux
Red Hat:satellite_capsule:6.14::el8
 before 0:2.0.0-1.el8pc
0:2.0.0-1.el8pc
python-django-import-export
Red Hat:satellite_capsule:6.14::el8
 before 0:3.1.0-1.el8pc
0:3.1.0-1.el8pc
python-pulp-rpm
Red Hat:satellite_capsule:6.14::el8
 before 0:3.19.11-2.el8pc
0:3.19.11-2.el8pc
python-pulpcore
Red Hat:satellite_capsule:6.14::el8
 before 0:3.22.19-1.el8pc
0:3.22.19-1.el8pc
python-urllib3
Red Hat:satellite_capsule:6.14::el8
 before 0:1.26.18-0.1.el8pc
0:1.26.18-0.1.el8pc
python3-createrepo_c
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python3-createrepo_c-debuginfo
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-createrepo_c
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-createrepo_c-debuginfo
Red Hat:satellite_capsule:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-django-import-export
Red Hat:satellite_capsule:6.14::el8
 before 0:3.1.0-1.el8pc
0:3.1.0-1.el8pc
python39-pulp-rpm
Red Hat:satellite_capsule:6.14::el8
 before 0:3.19.11-2.el8pc
0:3.19.11-2.el8pc
python39-pulpcore
Red Hat:satellite_capsule:6.14::el8
 before 0:3.22.19-1.el8pc
0:3.22.19-1.el8pc
python39-urllib3
Red Hat:satellite_capsule:6.14::el8
 before 0:1.26.18-0.1.el8pc
0:1.26.18-0.1.el8pc
rubygem-smart_proxy_remote_execution_ssh
Red Hat:satellite_capsule:6.14::el8
 before 0:0.10.2-2.el8sat
0:0.10.2-2.el8sat
satellite
Red Hat:satellite_capsule:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-capsule
Red Hat:satellite_capsule:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-common
Red Hat:satellite_capsule:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite
Red Hat:satellite_utils:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-cli
Red Hat:satellite_utils:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
createrepo_c
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-debuginfo
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-debugsource
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-libs
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
createrepo_c-libs-debuginfo
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
pulpcore-selinux
Red Hat:satellite:6.14::el8
 before 0:2.0.0-1.el8pc
0:2.0.0-1.el8pc
python-django-import-export
Red Hat:satellite:6.14::el8
 before 0:3.1.0-1.el8pc
0:3.1.0-1.el8pc
python-pulp-rpm
Red Hat:satellite:6.14::el8
 before 0:3.19.11-2.el8pc
0:3.19.11-2.el8pc
python-pulpcore
Red Hat:satellite:6.14::el8
 before 0:3.22.19-1.el8pc
0:3.22.19-1.el8pc
python-urllib3
Red Hat:satellite:6.14::el8
 before 0:1.26.18-0.1.el8pc
0:1.26.18-0.1.el8pc
python3-createrepo_c
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python3-createrepo_c-debuginfo
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-createrepo_c
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-createrepo_c-debuginfo
Red Hat:satellite:6.14::el8
 before 0:1.0.2-2.el8pc
0:1.0.2-2.el8pc
python39-django-import-export
Red Hat:satellite:6.14::el8
 before 0:3.1.0-1.el8pc
0:3.1.0-1.el8pc
python39-pulp-rpm
Red Hat:satellite:6.14::el8
 before 0:3.19.11-2.el8pc
0:3.19.11-2.el8pc
python39-pulpcore
Red Hat:satellite:6.14::el8
 before 0:3.22.19-1.el8pc
0:3.22.19-1.el8pc
python39-urllib3
Red Hat:satellite:6.14::el8
 before 0:1.26.18-0.1.el8pc
0:1.26.18-0.1.el8pc
rubygem-actioncable
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-actionmailbox
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-actionmailer
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-actiontext
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-actionview
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-activejob
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-activemodel
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-activerecord
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-activestorage
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-activesupport
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-foreman_leapp
Red Hat:satellite:6.14::el8
 before 0:1.1.0-1.el8sat
0:1.1.0-1.el8sat
rubygem-foreman_remote_execution
Red Hat:satellite:6.14::el8
 before 0:10.1.2-1.el8sat
0:10.1.2-1.el8sat
rubygem-foreman_remote_execution-cockpit
Red Hat:satellite:6.14::el8
 before 0:10.1.2-1.el8sat
0:10.1.2-1.el8sat
rubygem-katello
Red Hat:satellite:6.14::el8
 before 0:4.9.0.18-1.el8sat
0:4.9.0.18-1.el8sat
rubygem-rails
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-railties
Red Hat:satellite:6.14::el8
 before 0:6.1.7.4-1.el8sat
0:6.1.7.4-1.el8sat
rubygem-smart_proxy_remote_execution_ssh
Red Hat:satellite:6.14::el8
 before 0:0.10.2-2.el8sat
0:0.10.2-2.el8sat
satellite
Red Hat:satellite:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-cli
Red Hat:satellite:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-common
Red Hat:satellite:6.14::el8
 before 0:6.14.1-1.el8sat
0:6.14.1-1.el8sat
satellite-convert2rhel-toolkit
Red Hat:satellite:6.14::el8
 before 0:1.0.0-1.el8sat
0:1.0.0-1.el8sat
rubygem-actionpack-5_1
SUSE:Linux Enterprise High Availability Extension 15 SP1
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
SUSE:Linux Enterprise High Availability Extension 15 SP2
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
SUSE:Linux Enterprise High Availability Extension 15 SP3
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
SUSE:Linux Enterprise High Availability Extension 15 SP4
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
SUSE:Linux Enterprise High Availability Extension 15 SP5
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
openSUSE:Leap 15.4
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-5_1
openSUSE:Leap 15.5
 before 5.1.4-150000.3.18.1
5.1.4-150000.3.18.1
rubygem-actionpack-4_2
SUSE:OpenStack Cloud Crowbar 8
 before 4.2.9-7.18.1
4.2.9-7.18.1
rubygem-actionpack-4_2
SUSE:OpenStack Cloud Crowbar 9
 before 4.2.9-7.18.1
4.2.9-7.18.1
rails
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2
 None known
rails
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2
 None known
rails
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1
 None known
rails
Ubuntu:Pro:22.04:LTS
 All versions, plus listed versions
2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1
 None known
rails
Ubuntu:24.04:LTS
 All versions, plus listed versions
2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3
 None known
rails
Ubuntu:25.10
 All versions, plus listed versions
2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7
 None known
rails
Ubuntu:26.10
 All versions, plus listed versions
2:7.2.3+dfsg-22:7.2.3.2+dfsg-2
 None known
rails
Ubuntu:26.04:LTS
 All versions, plus listed versions
2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2
 None known

History

History
WhenChangedSources
2026-11-02createdCVE List, EUVD, GitHub Advisories, NVD, OSV

References

Show 49 moreShow less
This page doesn't list everything

Left out here: 375 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open