« Volver al listado

CVE-2018-16476

Estado: ModificadaAlta (7.5)—

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Redhat — CloudformsRubyonrails — Rails

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-16476",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "https://github.com/rails/rails",
          "versions": [
            {
              "status": "affected",
              "version": "4.2.0 up to and before 4.2.11"
            },
            {
              "status": "affected",
              "version": "4.2.0 up to and before 5.0.7.1"
            },
            {
              "status": "affected",
              "version": "4.2.0 up to and before 5.1.6.1"
            },
            {
              "status": "affected",
              "version": "4.2.0 up to and before 5.2.1.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-30T19:29:00.220",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:0600",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2019:0600",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ",
      "tags": [
        "Exploit",
        "Mailing List",
        "Mitigation",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "support@hackerone.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-502"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad del Control de acceso roto en las versiones de Trabajo activo> = versión 4.2.0 permite a un atacante crear una entrada de usuario que puede hacer que el Trabajo activo lo deserialice con GlobalId y les dé acceso a la información que no deberían tener. Esta vulnerabilidad se ha corregido en las versiones 4.2.11, 5.0.7.1, 5.1.6.1 y 5.2.1.1."
    }
  ],
  "lastModified": "2026-06-17T01:44:21.637",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "91E13D8E-83B0-4378-ABE8-C3D3E8620E91",
              "versionEndExcluding": "4.2.11",
              "versionStartIncluding": "4.2.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69CD5219-EC1C-472E-9972-185FE18F6551",
              "versionEndExcluding": "5.0.7.1",
              "versionStartIncluding": "5.0.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "55306814-6369-428E-A528-C41963AECB2D",
              "versionEndExcluding": "5.1.6.1",
              "versionStartIncluding": "5.1.0"
            },
            {
              "criteria": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "23319E2C-3EFF-4360-86C4-2CCC08333588",
              "versionEndExcluding": "5.2.1.1",
              "versionStartIncluding": "5.2.0"
            }
          ],
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67F7263F-113D-4BAE-B8CB-86A61531A2AC"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}