CVE-2023-28362

MediumCVSS 4.0/10Last modified Jun 17, 2026

Description

The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.

Metrics

CVSS 3.1 4.0/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-116

Affected software

No affected versions have been published.

Timeline

Published: Jan 9, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-283646.1An Open Redirect vulnerability exists prior to version 1.52.117, where the built-in QR scanner in Brave Browser Android navigated to scanned CVE-2023-283659.1A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application a CVE-2023-283667.5The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2 CVE-2023-283675.4Cross-site scripting vulnerability in CTA post function of VK All in One Expansion Unit 9.88.1.0 and earlier allows a remote authenticated a CVE-2023-283685.7TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys. A fake dev CVE-2023-283693.3Brother iPrint&Scan V6.11.2 and earlier contains an improper access control vulnerability. This vulnerability may be exploited by the other CVE-2023-28375.5Stack-based Buffer Overflow in GitHub repository gpac/gpac prior to 2.2.2.CVE-2023-283706.1Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrar CVE-2023-283719.8In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or .. directory CVE-2023-283722.7A flaw exists in FlashBlade Purity (OE) Version 4.1.0 whereby a user with privileges to extend an object’s retention period can affect the CVE-2023-283732.7A flaw exists in FlashArray Purity whereby an array administrator by configuring an external key manager can affect the availability of data CVE-2023-283746.5Improper input validation for some Intel(R) PROSet/Wireless and Intel(R) Killer(TM) Wi-Fi software before version 22.240 may allow an unauth