Session fixation vulnerability in Rails

MEDIUM 6.8CVE-2007-5380 · GHSA-jwhv-rgqc-fqj5 · Published 19/10/2007 · updated 16/06/2026

Package	Affected versions	Patched versions
rails RubyGems	`< 1.2.4`	`1.2.4`
ruby on rails david_hansson	`≤ 1.2.3`	No fix yet

Description

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

NVD description

Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."

References

nvd.nist.gov/vuln/detail/CVE-2007-5380 · ADVISORY
GitHub Advisory GHSA-jwhv-rgqc-fqj5 · ADVISORY
rails/rails · PACKAGE
rubysec/ruby-advisory-db · WEB
bugs.gentoo.org/show_bug.cgi · WEB
docs.info.apple.com/article.html · WEB
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html · WEB
secunia.com/advisories/27657 · WEB
secunia.com/advisories/27965 · WEB
secunia.com/advisories/28136 · WEB
security.gentoo.org/glsa/glsa-200711-17.xml · WEB
weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release · WEB
novell.com/linux/security/advisories/2007_25_sr.html · WEB
securityfocus.com/bid/26096 · WEB
us-cert.gov/cas/techalerts/TA07-352A.html · WEB
vupen.com/english/advisories/2007/3508 · WEB
vupen.com/english/advisories/2007/4238 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free