>> Ruby on Rails CgiRequest Constructor "cookie_only" Session Fixation Issue
Title : Ruby on Rails CgiRequest Constructor "cookie_only" Session Fixation Issue VUPEN ID : VUPEN/ADV-2007-4009 CVE ID : CVE-2007-6077
Rated as : Low Risk
Remotely Exploitable : Yes Locally Exploitable : Yes Release Date : 2007-11-27
Technical Description
A vulnerability has been identified in Ruby on Rails, which could be exploited by attackers to bypass security restrictions. This issue is caused by an error in the CgiRequest constructor [lib/action_controller/cgi_process.rb] that removes the ":cookie_only" attribute from "DEFAULT_SESSION_OPTIONS", which could potentially be exploited to conduct session fixation attacks and gain unauthorized access to an affected application.
