Unrated
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize...
CVE-2018-16476
First seen on SecPulse
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2018-16476 rails Fixed in: 2:5.2.2+dfsg-1
Original description The description as published by the source.
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory access.redhat.com
- advisory weblog.rubyonrails.org
- report groups.google.com