CVE-2024-26144

Katalog CVE

CVSS 5.3 · Medium EPSS 1,1%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada rubyonrails rails. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Rincian

Terbit di NVD

27 Februari 2024

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 65,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945 advisory vendor
• https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g advisory vendor
• https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433 patch
• https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3 patch
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20240510-0013/ advisory pihak ketiga