FreeBSD : Rails -- Active Job vulnerability (f96044a2-7df9-414b-9f6b-6e5b85d06c86)

high Nessus Plugin ID 119317



The remote FreeBSD host is missing one or more security-related updates.


Ruby on Rails blog :

Rails 4.2.11,, and have been released! These contain the following important security fixes, and it is recommended that users upgrade as soon as possible

CVE-2018-16476 Broken Access Control vulnerability in Active Job :
Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.


Update the affected packages.

See Also

Plugin Details

Severity: High

ID: 119317

File Name: freebsd_pkg_f96044a27df9414b9f6b6e5b85d06c86.nasl

Version: 1.3

Type: local

Published: 12/3/2018

Updated: 6/18/2020

Risk Information


Risk Factor: Low

Score: 3.6


Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Temporal Vector: E:U/RL:OF/RC:C


Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:rubygem-activejob4, p-cpe:/a:freebsd:freebsd:rubygem-activejob5, p-cpe:/a:freebsd:freebsd:rubygem-activejob50, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 12/2/2018

Vulnerability Publication Date: 11/27/2018

Reference Information

CVE: CVE-2018-16476