Skip to content
Fencer Vulns
high 7.5

CVE-2018-16476 json

Improper Access Control in activejob

published 2018-11-30 7 y ago modified 2026-06-17 4 mo ago also GHSA-q2qw-rmrh-vv42 , EUVD-2018-0818

cvss
7.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.9%
EPSS 2.9% chance of exploitation in 30 days, percentile 86%
public exploits
0
none known

Summary

A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

Patch / fix

  • rubygems activejob 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1
  • rubyonrails rails 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1
  • rails Debian 14, Debian 13, Debian 12 2:5.2.2+dfsg-1

debian advisories DEBIAN-CVE-2018-16476

  • cfme cloudforms managementengine 5.9 5.9.9.1-1.el7cf
  • cfme-gemset cloudforms managementengine 5.9 5.9.9.1-1.el7cf
  • cfme-appliance cloudforms managementengine 5.9 5.9.9.1-1.el7cf
  • cfme-appliance-tools cloudforms managementengine 5.9 5.9.9.1-1.el7cf
  • cfme-appliance-common cloudforms managementengine 5.9 5.9.9.1-1.el7cf
  • cfme-amazon-smartstate cloudforms managementengine 5.9 5.9.9.1-1.el7cf

red hat advisories RHSA-2019:0600

  • rubygem-activejob-4_2 OpenStack Cloud Crowbar 8, OpenStack Cloud 7, Enterprise Storage 4 4.2.9-3.6.1
  • rubygem-activejob-5_1 SLE High Availability Extension 15 5.1.4-3.3.1

suse advisories SUSE-SU-2019:0152-1SUSE-SU-2018:3996-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16476 updated cvss 4.3

activejob: Information Exposure through deserialization using GlobalId

  • Red Hat Satellite 6 tfm-ror51-rubygem-activejob Red Hat Software Collections rh-ror42-rubygem-activejob, rh-ror50-rubygem-activejob
    affected: no fix planned “Will not fix”
  • Red Hat CloudForms Management Engine 5.9 cfme 5.9.9.1-1.el7cf, cfme-gemset 5.9.9.1-1.el7cf, cfme-appliance 5.9.9.1-1.el7cf, cfme-appliance-tools 5.9.9.1-1.el7cf, cfme-appliance-common 5.9.9.1-1.el7cf, cfme-amazon-smartstate 5.9.9.1-1.el7cf
    fixed: vendor fix RHSA-2019:0600

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.86% chance of exploitation in the next 30 days, higher than 86% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • groups.google.com https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 5.0 AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem package affected fixed in
rubygems activejob
>=4.2.0, <4.2.11
>=5.0.0, <5.0.7.1
>=5.1.0, <5.1.6.1
>=5.2.0, <5.2.1.1
4.2.11
5.0.7.1
5.1.6.1
5.2.1.1

Affected products

  • n/a https://github.com/rails/rails

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-502 Deserialization of Untrusted Data
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.