CVE-2007-6077

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the…

published November 21, 2007

CVSS
—
EPSS
3%
Percentile
84.6
In the wild
Unconfirmed
What it is

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02512 · 84.6th percentile
Published
2007-11-21T21:00Z
EPSS history
Timeline
  • 21 NOV 21:00Z
    The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the…
    cvelistv5