GitHub Advisoryadvisory · RubyGems

GHSA-jwhv-rgqc-fqj5 Session fixation vulnerability in Rails

MEDIUM Published 2017-10-24 Modified 2025-04-09 Official page ↗
Aliases
CVE-2007-5380
Ecosystem
RubyGems
Packages
rails
Severity
Moderate
Weaknesses
CWE-384
Reviewed
2020-06-16

Affected packages

• RubyGems rails: < 1.2.4 → fixed in 1.2.4

Description

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

Related

Alias · CVE (1)

  • CVE-2007-5380 Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via… vulnerability

Weakness · CWE (1)

  • CWE-384 Session Fixation weakness

References