VDB
CVE-2007-5380
CVE-2007-5380
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
EPSS 6.07% · 90.9th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
6.07%
90.9th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| david_hansson | ruby_on_rails | 0 |
| n/a | n/a | n/a |
| RubyGems | rails | 0 |
Timeline
- Oct 19, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Sep 8, 2023 EPSS Score
- Oct 30, 2023 EPSS Score
- Dec 22, 2023 EPSS Score
References
- http://secunia.com/advisories/27657 technical
- http://secunia.com/advisories/27965 technical
- http://secunia.com/advisories/28136 technical
- ADV-2007-4238 vdb
- ADV-2007-3508 vdb
- TA07-352A third-party-advisory
- 26096 vdb
- GLSA-200711-17 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=195315 url
- SUSE-SR:2007:025 vendor-advisory
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release url
- APPLE-SA-2007-12-17 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307179 url
- https://nvd.nist.gov/vuln/detail/CVE-2007-5380 advisory
- https://github.com/advisories/GHSA-jwhv-rgqc-fqj5 advisory
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5380.yml url