CVE-2021-41263

Katalog CVE

CVSS 8.8 · High EPSS 0,63%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada discourse rails multisite. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

rails_multisite provides multi-db support for Rails applications. In affected versions this vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.

Rincian

Terbit di NVD

15 November 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-565: Reliance on Cookies without Validation and Integrity Checking
CWE-327: Use of a Broken or Risky Cryptographic Algorithm

EPSS (30 hari)

0,63% peluang dieksploitasi; lebih tinggi dari 48,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0 patch · advisory pihak ketiga
• https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh advisory pihak ketiga