Access Restriction Bypass Affecting activejob package, versions >=4.2.0, <4.2.11 >=5.0.0, <5.0.7.1 >=5.1.1, <5.1.6.1 >=5.2.0, <5.2.1.1


0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.16% (52nd percentile)
Expand this section
NVD
7.5 high
Expand this section
SUSE
6.5 medium
Expand this section
Red Hat
4.3 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-ACTIVEJOB-72640
  • published 28 Nov 2018
  • disclosed 28 Nov 2018
  • credit Unknown

How to fix?

Upgrade activejob to version 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1 or higher.

Overview

activejobdeclares job classes that can be run by a variety of queueing backends.

Affected versions of this package are vulnerable to Access Restriction Bypass. Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.