VDB
CVE-2007-5380
CVE-2007-5380
PUBLISHED
CVSS 6.800000190734863 MEDIUM
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
EPSS 3.58% · 89.3th percentile
Risk Scores
CVSS 2.0
6.800000190734863
EPSS Score
3.58%
89.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| david_hansson | ruby_on_rails | 0 |
| n/a | n/a | n/a |
| RubyGems | rails | 0 |
Timeline
- Oct 19, 2007 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- Jul 13, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Dec 20, 2022 EPSS Score
- Feb 11, 2023 EPSS Score
- Apr 5, 2023 EPSS Score
- May 28, 2023 EPSS Score
- Sep 11, 2023 EPSS Score
- Nov 3, 2023 EPSS Score
- Feb 17, 2024 EPSS Score
References
- 27965 third-party-advisory
- TA07-352A third-party-advisory
- 28136 third-party-advisory
- GLSA-200711-17 vendor-advisory
- http://bugs.gentoo.org/show_bug.cgi?id=195315 url
- SUSE-SR:2007:025 vendor-advisory
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release url
- http://docs.info.apple.com/article.html?artnum=307179 url
- ADV-2007-4238 vdb
- ADV-2007-3508 vdb
- 26096 vdb
- APPLE-SA-2007-12-17 vendor-advisory
- 27657 third-party-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2007-5380 advisory
- https://github.com/advisories/GHSA-jwhv-rgqc-fqj5 advisory
- https://github.com/rails/rails package
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5380.yml url