Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
BID:62657
Info
Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
| Bugtraq ID: | 62657 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 26 2013 12:00AM |
| Updated: | Mar 19 2015 08:19AM |
| Credit: | G. S. McNamara |
| Vulnerable: |
Ruby on Rails Ruby on Rails 3.2.4 Ruby on Rails Ruby on Rails 3.2.2 Ruby on Rails Ruby on Rails 3.1.5 Ruby on Rails Ruby on Rails 3.1.4 Ruby on Rails Ruby on Rails 3.1.2 Ruby on Rails Ruby on Rails 3.0.13 Ruby on Rails Ruby on Rails 3.0.12 Ruby on Rails Ruby on Rails 3.0.11 Ruby on Rails Ruby on Rails 3.0.6 Ruby on Rails Ruby on Rails 3.0.5 Ruby on Rails Ruby on Rails 3.0.4 Ruby on Rails Ruby on Rails 3.0.3 Ruby on Rails Ruby on Rails 3.0.2 Ruby on Rails Ruby on Rails 3.0.1 Ruby on Rails Ruby on Rails 3.0 Ruby on Rails Ruby on Rails 2.3.11 Ruby on Rails Ruby on Rails 2.3.10 Ruby on Rails Ruby on Rails 2.3.9 Ruby on Rails Ruby on Rails 2.3.5 Ruby on Rails Ruby on Rails 2.3.4 Ruby on Rails Ruby on Rails 2.3.3 Ruby on Rails Ruby on Rails 2.3.2 Ruby on Rails Ruby on Rails 2.2.3 Ruby on Rails Ruby on Rails 2.2.2 Ruby on Rails Ruby on Rails 2.1.1 Ruby on Rails Ruby on Rails 2.1 Ruby on Rails Ruby on Rails 2.0.5 Ruby on Rails Ruby on Rails 2.0.4 Ruby on Rails Ruby on Rails 2.0 Ruby on Rails Ruby on Rails 3.0.8 Ruby on Rails Ruby on Rails 3.0.7 Ruby on Rails Ruby on Rails 3.0.10 Ruby on Rails Ruby on Rails 2.3.14 Ruby on Rails Ruby on Rails 2.3.13 Ruby on Rails Ruby on Rails 2.3.12 Redmine Redmine 1.3.2 Redmine Redmine 1.1.2 Redmine Redmine 1.1.1 Redmine Redmine 1.0.5 Redmine Redmine 1.0.4 Redmine Redmine 1.0.1 Redmine Redmine 1.3 Redmine Redmine 1.1.0 Redmine Redmine 1.0.3 Redmine Redmine 1.0.2 Redmine Redmine 1.0.0 Redmine Redmine 0.9.6 Redmine Redmine 0.9.5 Redmine Redmine 0.9.4 Redmine Redmine 0.9.3 Redmine Redmine 0.9.2 Redmine Redmine 0.9.1 Redmine Redmine 0.9.0 |
| Not Vulnerable: | |
Discussion
Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
Ruby on Rails is prone to a security vulnerability that affects the CookieStore because it fails to properly invalidate the old cookies upon sign out.
Attackers can exploit this issue to gain unauthorized access to an affected application.
Ruby on Rails is prone to a security vulnerability that affects the CookieStore because it fails to properly invalidate the old cookies upon sign out.
Attackers can exploit this issue to gain unauthorized access to an affected application.
Exploit / POC
Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
An attacker can exploit this issue using a web browser.
An attacker can exploit this issue using a web browser.
Solution / Fix
Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Ruby on Rails CookieStore Session Cookie Persistence Security Vulnerability
References:
References: