CVE-2007-6077: The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the…

PriorityP424medium6.8CVSS 2.0

AVNACMAuNCPIPAP

EPSS

2.51%

82.7th percentile

The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
debian	rails	< rails 1.2.6-1 (bookworm)	rails 1.2.6-1 (bookworm)
rubyonrails	rails	—	—
rubyonrails	rails	>= 0 < 1.2.6-1	1.2.6-1
rubyonrails	rails	>= 0 < 1.2.6-1	1.2.6-1
rubyonrails	rails	>= 0 < 1.2.6-1	1.2.6-1
rubyonrails	rails	>= 0 < 1.2.6-1	1.2.6-1
rubyonrails	rails	>= 0 < 1.2.6	1.2.6

CVSS provenance

nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

ghsa6.8MEDIUM

osv6.8MEDIUM

vendor_debian6.8LOW

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.