Remote Yes

Type Information disclosure

Description

There is a possible information disclosure/unintended method execution vulnerability in Action Pack before versions 6.1.3.2, 6.0.3.7, 5.2.4.6 and 5.2.6 when using the "redirect_to" or "polymorphic_url" helper with untrusted user input.

AVG-1921 metasploit 6.0.37-1 Medium Vulnerable

AVG-1920 redmine 4.2.0-1 Medium Vulnerable

AVG-1905 gitlab-gitaly 13.10.0-2 Medium Vulnerable

AVG-1904 gitlab 13.10.4-1 Medium Vulnerable

https://www.openwall.com/lists/oss-security/2021/05/05/3