CVE catalog

CVE-2023-22797

rails: CVE-2023-22797

[CVE catalog]

Severity
Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.60% · Oct 25, 2026

An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the check introduced could allow an attacker to bypass with a carefully crafted URL resulting in an open redirect vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrailssid2:7.2.4+dfsg-2not affected
Debianrailsforky2:7.2.4+dfsg-1not affected
Debianrailstrixie2:7.2.2.2+dfsg-2~deb13u1not affected
Debianrailstrixie-security2:7.2.2.2+dfsg-2~deb13u2not affected
Debianrailsbookworm2:6.1.7.10+dfsg-1~deb12u2not affected
Debianrailsbookworm-security2:6.1.7.10+dfsg-1~deb12u3not affected

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
DebianrailssourcesidNot affectedunimportantNot reportedNot reported
DebianrailssourceforkyNot affectedunimportantNot reportedNot reported
DebianrailssourcetrixieNot affectedunimportantNot reportedNot reported
DebianrailssourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [SUSE security advisories and VEX]