Cookie Prefix Forgery Vulnerability in Rack by Ruby
CVE-2020-8184
7.5HIGH
Key Information:
- Vendor
Rack Project
- Vendor
- CVE Published:
- 19 June 2020
What is CVE-2020-8184?
A vulnerability exists in Rack versions below 2.2.3 and 2.1.4 that stems from inadequate validation of cookies. Specifically, this flaw allows an attacker to forge secure or host-only cookie prefixes, potentially leading to unauthorized access and manipulation of session data. Developers using affected versions of Rack must upgrade to ensure proper cookie integrity and security.
Affected Version(s)
https://github.com/rack/rack rack >= 2.2.3, rack >= 2.1.4