CVE-2007-5380 Session fixation vulnerability in Rails
MediumCVSS 6.8
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rails(RubyGems) | < 1.2.4 | 1.2.4 |
| david hansson ruby on rails | <= 1.2.3 | No fix listed |
| rubygems rails(RubyGems) | = 0.10.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.10.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.11.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.11.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.12.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.12.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.13.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.13.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.2 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.3 | No fix listed |
| rubygems rails(RubyGems) | = 0.14.4 | No fix listed |
| rubygems rails(RubyGems) | = 0.8.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.8.5 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.0 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.2 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.3 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.4 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.4.1 | No fix listed |
| rubygems rails(RubyGems) | = 0.9.5 | No fix listed |
| rubygems rails(RubyGems) | = 1.0.0 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.0 | No fix listed |
Show 13 more
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems rails(RubyGems) | = 1.1.1 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.2 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.3 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.4 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.5 | No fix listed |
| rubygems rails(RubyGems) | = 1.1.6 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.0 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.1 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.2 | No fix listed |
| rubygems rails(RubyGems) | = 1.2.3 | No fix listed |
| debian/rails(Debian:12) | < 1.2.5-1 | 1.2.5-1 |
| debian/rails(Debian:13) | < 1.2.5-1 | 1.2.5-1 |
| debian/rails(Debian:14) | < 1.2.5-1 | 1.2.5-1 |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com vendor-advisory
- bugs.gentoo.org
- docs.info.apple.com
- APPLE-SA-2007-12-17 vendor-advisory
- 27657 third-party-advisory
- 27965 third-party-advisory
- 28136 third-party-advisory
- GLSA-200711-17 vendor-advisory
- weblog.rubyonrails.org
- SUSE-SR:2007:025 vendor-advisory
- 26096 patch vdb-entry
- TA07-352A third-party-advisory us-government-resource
- ADV-2007-3508 vdb-entry
- ADV-2007-4238 vdb-entry
- github.com exploit
- github.com product
- Debian Security Tracker CVE-2007-5380 vendor-advisory