The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore…
Priority LOW 11Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
Why it matters now
EPSS 0.00364 30th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:yukihiro_matsumoto:ruby:1.6:*:*:*:*:*:*:* | 1.6 | Vulnerable | Yukihiro Matsumoto |
| cpe:2.3:a:yukihiro_matsumoto:ruby:1.8:*:*:*:*:*:*:* | 1.8 | Vulnerable | Yukihiro Matsumoto |
- cpe:2.3:a:yukihiro_matsumoto:ruby:1.6:*:*:*:*:*:*:* Versions 1.6 Vulnerable ·Yukihiro Matsumoto
- cpe:2.3:a:yukihiro_matsumoto:ruby:1.8:*:*:*:*:*:*:* Versions 1.8 Vulnerable ·Yukihiro Matsumoto
Remediation
Red Hat 1 advisory
- RHSA-2004:441 Released 2004-09-30 · Red Hat rating Lowruby security update
- Red Hat Desktop version 3 irb-1.6.8-9.EL3.2, irb-1.6.8-9.EL3.2.i386, ruby-1.6.8-9.EL3.2 +11
- Red Hat Enterprise Linux AS version 3 irb-1.6.8-9.EL3.2, irb-1.6.8-9.EL3.2.i386, irb-1.6.8-9.EL3.2.ia64 +25
- Red Hat Enterprise Linux ES version 3 irb-1.6.8-9.EL3.2, irb-1.6.8-9.EL3.2.i386, irb-1.6.8-9.EL3.2.ia64 +18
- Red Hat Enterprise Linux WS version 3 irb-1.6.8-9.EL3.2, irb-1.6.8-9.EL3.2.i386, irb-1.6.8-9.EL3.2.ia64 +18
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Desktop version 3 | Fixed | RHSA-2004:441 |
| Red Hat Enterprise Linux AS version 3 | Fixed | RHSA-2004:441 |
| Red Hat Enterprise Linux ES version 3 | Fixed | RHSA-2004:441 |
| Red Hat Enterprise Linux WS version 3 | Fixed | RHSA-2004:441 |
Timeline
- 2026-10-02 Threatist record created from CVE-2004-0755
- 2026-10-03 Alias added: GHSA-59m9-8c72-5426
References
More Yukihiro Matsumoto Ruby vulnerabilities
- TI-2005-01883 The XMLRPC server in utils.rb for the ruby library (libruby) 1.8 sets an invalid default… CVSS 2.0HIGH 7.5
- TI-2005-02214 Ruby 1.6.x up to 1.6.8, 1.8.x up to 1.8.2, and 1.9.0 development up to 2005-09-01 allows… CVSS 2.0HIGH 7.5
- TI-2006-03581 Multiple unspecified vulnerabilities in Ruby before 1.8.5 allow remote attackers to… CVSS 2.0MEDIUM 6.4
- TI-2006-01876 The HTTP/XMLRPC server in Ruby before 1.8.2 uses blocking sockets, which allows attackers… CVSS 2.0MEDIUM 5.0
- TI-2006-06067 The read_multipart function in cgi.rb in Ruby before 1.8.5-p2 does not properly detect… CVSS 2.0MEDIUM 5.0
- TI-2006-05279 The cgi.rb CGI library for Ruby 1.8 allows remote attackers to cause a denial of service… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2004-0755 · CVE Program
- CVE-2004-0755 · NVD
- FIRST EPSS
- GHSA-59m9-8c72-5426 · GitHub Advisory Database · CC BY 4.0
- CVE-2004-0755 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences