Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*
There are 41 matching records.
Displaying matches 41 through 41.
Vuln ID Summary CVSS Severity

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

Published: November 21, 2007; 4:46:00 PM -0500
V3.x:(not available)
V2.0: 6.8 MEDIUM