Fluid Attacks Database

Description

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	rails	=2:6.1.7.3+dfsg-1 \|\| =2:6.1.7.3+dfsg-10 \|\| =2:6.1.7.3+dfsg-11 \|\| =2:6.1.7.3+dfsg-12 \|\| =2:6.1.7.3+dfsg-13 \|\| =2:6.1.7.3+dfsg-2 \|\| =2:6.1.7.3+dfsg-2~deb12u1 \|\| =2:6.1.7.3+dfsg-3 \|\| =2:6.1.7.3+dfsg-4 \|\| =2:6.1.7.3+dfsg-5 \|\| =2:6.1.7.3+dfsg-6 \|\| =2:6.1.7.3+dfsg-7 \|\| =2:6.1.7.3+dfsg-7~exp1 \|\| =2:6.1.7.3+dfsg-8 \|\| =2:6.1.7.3+dfsg-9 \|\| >=0 <2:6.1.7.10+dfsg-1~deb12u1	2:6.1.7.10+dfsg-1~deb12u1
debian 13	rails	>=0 <2:7.2.2.1+dfsg-1	2:7.2.2.1+dfsg-1
debian 14	rails	>=0 <2:7.2.2.1+dfsg-1	2:7.2.2.1+dfsg-1
rubygems	actionpack	>=0 <6.1.7.4 \|\| >=7.0.0 <7.0.5.1	6.1.7.4, 7.0.5.1

Aliases

1. CVE-2023-283622. NVD-2023-283623. OSV-DEBIAN-2023-283624. OSV-2023-283625. GCVE-2023-283626. SECURITY-TRACKER-CVE-2023-28362

References

1. https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f714412. https://github.com/rails/rails/commit/69e37c84e3f77d75566424c7d0015172d6a6fac53. https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc234. https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/831325. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml6. https://security.netapp.com/advisory/ntap-20250502-0009

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.