VulnerabilityModified
CVE-2007-5380
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
MEDIUM 6.8EPSS 3.58%
Does this matter?
Lower severity and a low EPSS score (3.58%). Track it; it rarely justifies an emergency change on its own.
Description
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
- CVSS 2.0
- 6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
- EPSS
- 3.58% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- david hansson/ruby on rails
- Source
- cve@mitre.org
References
- http://bugs.gentoo.org/show_bug.cgi?id=195315
- http://docs.info.apple.com/article.html?artnum=307179
- http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
- http://secunia.com/advisories/27657
- http://secunia.com/advisories/27965
- http://secunia.com/advisories/28136
- http://security.gentoo.org/glsa/glsa-200711-17.xml
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
- http://www.novell.com/linux/security/advisories/2007_25_sr.html
- http://www.securityfocus.com/bid/26096Patch
- http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3508
- http://www.vupen.com/english/advisories/2007/4238
- http://bugs.gentoo.org/show_bug.cgi?id=195315
- http://docs.info.apple.com/article.html?artnum=307179
- http://lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
- http://secunia.com/advisories/27657
- http://secunia.com/advisories/27965
- http://secunia.com/advisories/28136
- http://security.gentoo.org/glsa/glsa-200711-17.xml
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
- http://www.novell.com/linux/security/advisories/2007_25_sr.html
- http://www.securityfocus.com/bid/26096Patch
- http://www.us-cert.gov/cas/techalerts/TA07-352A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/3508
- http://www.vupen.com/english/advisories/2007/4238
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.