CVEDB API

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-22902

The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.

Exploit prediction scoring system (EPSS) score

EPSS Score 0.013

EPSS Ranking 79.0%

CVSS Severity

CVSS v3 Score 7.5

CVSS v2 Score 5.0

References

Products affected by CVE-2021-22902

Rubyonrails » Rails » Version: 6.0.0

cpe:2.3:a:rubyonrails:rails:6.0.0
Rubyonrails » Rails » Version: 6.0.1

cpe:2.3:a:rubyonrails:rails:6.0.1
Rubyonrails » Rails » Version: 6.0.2

cpe:2.3:a:rubyonrails:rails:6.0.2
Rubyonrails » Rails » Version: 6.0.2.1

cpe:2.3:a:rubyonrails:rails:6.0.2.1
Rubyonrails » Rails » Version: 6.0.2.2

cpe:2.3:a:rubyonrails:rails:6.0.2.2
Rubyonrails » Rails » Version: 6.0.3

cpe:2.3:a:rubyonrails:rails:6.0.3
Rubyonrails » Rails » Version: 6.0.3.1

cpe:2.3:a:rubyonrails:rails:6.0.3.1
Rubyonrails » Rails » Version: 6.0.3.2

cpe:2.3:a:rubyonrails:rails:6.0.3.2
Rubyonrails » Rails » Version: 6.0.3.3

cpe:2.3:a:rubyonrails:rails:6.0.3.3
Rubyonrails » Rails » Version: 6.0.3.4

cpe:2.3:a:rubyonrails:rails:6.0.3.4
Rubyonrails » Rails » Version: 6.0.3.5

cpe:2.3:a:rubyonrails:rails:6.0.3.5
Rubyonrails » Rails » Version: 6.0.3.6

cpe:2.3:a:rubyonrails:rails:6.0.3.6
Rubyonrails » Rails » Version: 6.1.0

cpe:2.3:a:rubyonrails:rails:6.1.0

Vulnerabilities

Vulnerable Software

Vulnerability Details CVE-2021-22902

Products

Pricing

Contact Us