CVE-2021-22881: fedoraproject fedora Open Redirect
Vulnerability summary
CVE-2021-22881 is a medium (CVSS 6.1) Open Redirect vulnerability in fedoraproject fedora. EPSS estimates a 87.30% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 11-02-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
87.30%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 87.30% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (hackerone.com)
Maturity: unknown
Exploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian1 product
- rails< 2:6.0.3.5+dfsg-1
Fedoraproject1 product
- fedoraEOL33
RubyGems1 product
- actionpack≥ 6.0.0, < 6.0.3.5 | ≥ 6.1.0, < 6.1.2.1
Rubyonrails1 product
- rails≥ 6.0.0, < 6.0.3.5 | ≥ 6.1.0, < 6.1.2.1
Ubuntu1 product
- railsAll versions (No fix recorded)
5 vendors · 5 products
References
19 links- benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/X Refsource MISCPatchThird Party Advisory
- www.openwall.com/lists/oss-security/2021/05/05/2Mailing ListX Refsource MLISTWEBMitigationThird Party Advisory
- www.openwall.com/lists/oss-security/2021/08/20/1Mailing ListX Refsource MLISTWEBMitigationThird Party Advisory
