CVE-2023-28362

MEDIUM Year: 2023
CVSS v3 Score
4.0
Medium
Weakness Type
CWE-116
View all →

Vulnerability Description

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Related Vulnerabilities

CVE-2020-4850

MEDIUM
CVSS:4.0(Medium)

IBM Spectrum Scale 1.1.1.0 through 1.1.8.4 Transparent Cloud Tiering could allow a remote attacker to obtain sensitive information, caused by the leftover files after configuration. IBM X-Force ID: 19...

CWE-1162020

CVE-2025-30345

MEDIUM
CVSS:4.1(Medium)

An issue was discovered in OpenSlides before 4.2.5. When creating new chats via the chat_group.create action, the user is able to specify the name of the chat. Some HTML elements such as SCRIPT are fi...

CWE-1162025

CVE-2020-27958

MEDIUM
CVSS:4.3(Medium)

The Job Composer app in Ohio Supercomputer Center Open OnDemand before 1.7.19 and 1.8.x before 1.8.18 allows remote authenticated users to provide crafted input in a job template.

CWE-1162020

CVE-2021-22254

MEDIUM
CVSS:4.3(Medium)

Under very specific conditions a user could be impersonated using Gitlab shell. This vulnerability affects GitLab CE/EE 13.1 and later through 14.1.2, 14.0.7 and 13.12.9.

CWE-1162021

CVE-2021-38751

MEDIUM
CVSS:4.3(Medium)

A HTTP Host header attack exists in ExponentCMS 2.6 and below in /exponent_constants.php. A modified HTTP header can change links on the webpage to an arbitrary value, leading to a possible attack vec...

CWE-1162021

CVE-2022-0124

MEDIUM
CVSS:4.3(Medium)

An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and al...

CWE-1162022