Access Restriction Bypass Affecting activejob package, versions >=4.2.0, <4.2.11 >=5.0.0, <5.0.7.1 >=5.1.1, <5.1.6.1 >=5.2.0, <5.2.1.1
Snyk CVSS
Attack Complexity
Low
Threat Intelligence
EPSS
0.16% (52nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVEJOB-72640
- published 28 Nov 2018
- disclosed 28 Nov 2018
- credit Unknown
Introduced: 28 Nov 2018
CVE-2018-16476 Open this link in a new tabHow to fix?
Upgrade activejob
to version 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1 or higher.
Overview
activejobdeclares job classes that can be run by a variety of queueing backends.
Affected versions of this package are vulnerable to Access Restriction Bypass. Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.