Description
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None
Affected Packages5 packages
▶Debianrails< 2:5.2.2+dfsg-1+3 🔴Vulnerability Details
4OSVImproper Access Control in activejob↗2018-12-05 GHSAImproper Access Control in activejob↗2018-12-05 CVEListCVE-2018-16476: A Broken Access Control vulnerability in Active Job versions >= 4↗2018-11-30 OSVCVE-2018-16476: A Broken Access Control vulnerability in Active Job versions >= 4↗2018-11-30 📋Vendor Advisories
2Red Hatactivejob: Information Exposure through deserialization using GlobalId↗2018-11-27 DebianCVE-2018-16476: rails - A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an ...↗2018 💬Community
2BugzillaCVE-2018-16476 activejob: Information Exposure through deserialization using GlobalId↗2018-12-13 BugzillaCVE-2018-16476 rubygem-activejob: activejob: Information Exposure through deserialization using GlobalId [fedora-all]↗2018-12-13