CVE-2023-22797: 
Ruby vulnerability analysis and mitigation

An open redirect vulnerability was discovered in Rails versions 7.0.0 up to (excluding) 7.0.4.1. The vulnerability was related to the redirect_to function when handling untrusted user input. While Rails 7.0.4.1 introduced new protection against open redirects, prior versions relied entirely on developers to ensure input trustworthiness (NVD, CVE).

The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site) with a CVSS v3.1 base score of 6.1 (Medium). The attack vector is network-based (AV:N) with low attack complexity (AC:L), requires no privileges (PR:N), and needs user interaction (UI:R). The scope is changed (S:C) with low confidentiality and integrity impact (C:L, I:L) and no availability impact (A:N) (NVD).

The vulnerability could allow an attacker to bypass the implemented security checks through a carefully crafted URL, resulting in successful open redirect attacks. This could potentially lead to phishing attacks or redirect users to malicious websites (NVD).

The vulnerability was fixed in Rails version 7.0.4.1. Users are strongly recommended to upgrade to this version or later to address the security issue. The fix includes improved protection against open redirects when using the redirect_to function with user input (Debian Tracker).