7.5

CVE-2021-22904

Exploit
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Rubyonrails ≫ Rails Version < 5.2.4.6
Rubyonrails ≫ Rails Version >= 5.2.5 < 5.2.6
Rubyonrails ≫ Rails Version >= 6.0.0 < 6.0.3.7
Rubyonrails ≫ Rails Version >= 6.1.0 < 6.1.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.81% 0.908
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:N/I:N/A:P
CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

https://security.netapp.com/advisory/ntap-20210805-0009/
Third Party Advisory
https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
Patch
Vendor Advisory
Exploit
Mitigation
https://hackerone.com/reports/1101125
Third Party Advisory
Permissions Required