CVE-2007-5380: Medium severity David Hansson Ruby On Rails vulnerability
Published Oct 19, 2007
·Updated
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
Affected Software
1 affected component
David Hansson Ruby On Rails<=1.2.3
Remediation
Patch Available
Event History
Oct 19, 2007
CVE Published
11:17 PM
Oct 20, 2007
CVE Published
via MITRE·03:00 AM
Data Sourced
via MITRE·03:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2007-5380?
CVE-2007-5380 has a medium severity rating as it allows remote attackers to hijack web sessions.
2
How do I fix CVE-2007-5380?
To fix CVE-2007-5380, upgrade Ruby on Rails to version 1.2.4 or later.
3
What versions of Ruby on Rails are affected by CVE-2007-5380?
CVE-2007-5380 affects Ruby on Rails versions prior to 1.2.4.
4
What type of vulnerability is CVE-2007-5380?
CVE-2007-5380 is a session fixation vulnerability.
5
Can CVE-2007-5380 be exploited remotely?
Yes, CVE-2007-5380 can be exploited remotely via URL-based sessions.