CVE-2022-23633: Exposure of sensitive information in Action Pack
Vulnerability summary
CVE-2022-23633 is a high (CVSS 7.4) vulnerability in debian debian_linux. EPSS estimates a 2.22% chance of exploitation in the next 30 days, higher than 82.6% of scored vulnerabilities.
Severe, CVSS 7.4 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 2% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 6 · Related 4Timeline
- 11-02-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · RubygemsEcosystem advisory · calculated7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- NVDNIST5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
2.22%
Chance of exploitation in the next 30 days
Percentile
83%
Versus all other CVEs
30-day change
Decrease -0.01 pp
From 2.23% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
- CWE-212Improper Removal of Sensitive Information Before Storage or TransferThe product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Opensuse3 products
- ruby3.2-rubygem-actionpack-7.0&distro=openSUSE Tumbleweed< 7.0.4.3-1.1
- rubygem-actionpack-6.0&distro=openSUSE Tumbleweed< 6.0.4.6-1.1
- rubygem-actionpack-7.0&distro=openSUSE Tumbleweed< 7.0.2.2-1.1
Debian2 products
- rails< 2:6.1.4.6+dfsg-1
- debian_linuxEOL10.0 | 11.0
Rails1 product
- rails≥ 7.0.0.0, < 7.0.2.1 | ≥ 6.1.0.0, < 6.1.4.5 | ≥ 6.0.0.0, < 6.0.4.5 | ≥ 5.0.0, < 5.2.6.1
RubyGems1 product
- actionpack≥ 5.0.0.0, < 5.2.6.2 | ≥ 6.0.0.0, < 6.0.4.6 | ≥ 6.1.0.0, < 6.1.4.6 | ≥ 7.0.0.0, < 7.0.2.2
Rubyonrails1 product
- rails≥ 5.0.0, < 5.2.6.2 | ≥ 6.0.0, < 6.0.4.6 | ≥ 6.1.0, < 6.1.4.6 | ≥ 7.0.0, < 7.0.2.2
Ubuntu1 product
- railsAll versions (No fix recorded)
6 vendors · 9 products
References
18 links- github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9REPORTWEBMitigationThird Party Advisory
- github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75daREPORTWEBPatchThird Party Advisory
Show all 18 references
- github.com/rails/railsPACKAGE