Moderate severityNVD Advisory· Published Nov 30, 2018· Updated Aug 5, 2024
CVE-2018-16477
CVE-2018-16477
Description
A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the content-disposition and content-type parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
activestorageRubyGems | >= 5.2.0, < 5.2.1.1 | 5.2.1.1 |
Affected products
1Patches
Vulnerability mechanics
References
5- github.com/advisories/GHSA-7rr7-rcjw-56vjghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-16477ghsaADVISORY
- groups.google.com/d/msg/rubyonrails-security/3KQRnXDIuLg/mByx5KkqBAAJghsax_refsource_MISCWEB
- weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-releasedghsaWEB
- weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released/mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.