GitHub Advisoryadvisory · RubyGems

GHSA-j6w9-fv6q-3q52 Rack allows Percent-encoded cookies to overwrite existing prefixed cookie names

HIGH Published 2020-06-24 Modified 2023-08-28 Official page ↗
Aliases
CVE-2020-8184
Ecosystem
RubyGems
Packages
rack
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-20, CWE-784
Reviewed
2020-06-24

Affected packages

• RubyGems rack: < 2.1.4 → fixed in 2.1.4 • RubyGems rack: >= 2.2.0, < 2.2.3 → fixed in 2.2.3

Description

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it possible for an attacker to forge a secure or host-only cookie prefix.

Related

Alias · CVE (1)

  • CVE-2020-8184 A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is… vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision weakness

References