CVE-2018-16476

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-502

Affected software

No affected versions have been published.

Timeline

Published: Nov 30, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-164776.5A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-dispos CVE-2018-164785.3A Path Traversal in simplehttpserver versions <=0.2.1 allows to list any file in another folder of web root.CVE-2018-164797.5Path traversal vulnerability in http-live-simulator <1.0.7 causes unauthorized access to arbitrary files on disk by appending extra slashes CVE-2018-16487.5IBM QRadar SIEM 7.2 and 7.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive info CVE-2018-164806.1A XSS vulnerability was found in module public <0.1.4 that allows malicious Javascript code to run in the browser, due to the absence of san CVE-2018-164816.1A XSS vulnerability was found in html-page <=2.1.1 that allows malicious Javascript code to be executed in the user's browser due to the abs CVE-2018-164827.5A server directory traversal vulnerability was found on node module mcstatic <=0.0.20 that would allow an attack to access sensitive informa CVE-2018-164838.8A deficiency in the access control in module express-cart <=1.1.5 allows unprivileged users to add new users to the application as administr CVE-2018-164845.4A XSS vulnerability was found in module m-server <1.4.2 that allows malicious Javascript code or HTML to be executed, due to the lack of esc CVE-2018-164856.5Path Traversal vulnerability in module m-server <1.4.1 allows malicious user to access unauthorized content of any file in the directory tre CVE-2018-164869.8A prototype pollution vulnerability was found in defaults-deep <=0.2.4 that would allow a malicious user to inject properties onto Object.pr CVE-2018-164875.6A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into