CVE-2021-22881

Description

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

How to fix CVE-2021-22881

To remediate CVE-2021-22881, upgrade the affected package to a fixed version below.

• —upgrade to 2:6.0.3.5+dfsg-1 or later
• —upgrade to 6.0.3.5 or later

Is CVE-2021-22881 being exploited?

Likely — EPSS is 87.3%, placing CVE-2021-22881 in the top tier of vulnerabilities by exploitation probability. Prioritise patching.

Affected packages (2)

• from 0, < 2:6.0.3.5+dfsg-1
• >= 6.0.0, < 6.0.3.5

CVSS scores

References (15)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2021-22881
• ADVISORYsecurity-tracker.debian.org/tracker/CVE-2021-22881
• WEBwww.openwall.com/lists/oss-security/2021/05/05/2
• WEBwww.openwall.com/lists/oss-security/2021/08/20/1
• WEB