CVE-2022-23633highCWE-200

CVE-2022-23633: high-severity vulnerability in rails

Exposure of sensitive information in Action Pack

Published · Updated

Follow this CVE+ Monitor rails+ Monitor rails

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 2.2%
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
rails · rails
Related CVEs — rails

In the same product, most dangerous first.

CVE-2026-66066CRITICALAction Pack: Possible arbitrary file read and remote code execution in Active Storage variant processingEPSS 32.9%CVE-2024-26142HIGHRails possible ReDoS vulnerability in Accept header parsing in Action DispatchEPSS 1.5%CVE-2024-26144MEDIUMPossible Sensitive Session Information Leak in Active StorageEPSS 1.3%CVE-2010-3299—CVE-2010-3299EPSS 1.1%CVE-2024-41128MEDIUMAction Dispatch has possible ReDoS vulnerability in query parameter filteringEPSS 1.1%CVE-2024-47887MEDIUMAction Controller has possible ReDoS vulnerability in HTTP Token authenticationEPSS 1.0%