VULNERABILITY INTELLIGENCE

CVE-2018-16476

CVSS score7.5 HIGH

EPSS probability2.86%

CISA KEVNot currently listed

Published2018-11-30

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Description

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

Weakness classification

CWE-284: Improper Access Control
CWE-502: Deserialization of Untrusted Data

Primary references

support@hackerone.com — Third Party Advisory
support@hackerone.com — Exploit, Mailing List, Mitigation, Third Party Advisory
support@hackerone.com — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Mitigation, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory