Access Restriction Bypass Affecting activejob package, versions >=4.2.0, <4.2.11>=5.0.0, <5.0.7.1>=5.1.1, <5.1.6.1>=5.2.0, <5.2.1.1


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.17% (55th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Access Restriction Bypass vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RUBY-ACTIVEJOB-72640
  • published28 Nov 2018
  • disclosed28 Nov 2018
  • creditUnknown

Introduced: 28 Nov 2018

CVE-2018-16476  (opens in a new tab)
CWE-284  (opens in a new tab)

How to fix?

Upgrade activejob to version 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1 or higher.

Overview

activejobdeclares job classes that can be run by a variety of queueing backends.

Affected versions of this package are vulnerable to Access Restriction Bypass. Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.

CVSS Base Scores

version 3.1