The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in…
Priority LOW 35CWE-362Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub.
Summary
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
Why it matters now
EPSS 0.02512 84th percentileScored 2026-11-07
Fix Fixed rails (RubyGems): 1.2.6
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | rails (RubyGems) | before 1.2.6 | 1.2.6 | Patch available | GHSA-p4c6-77gc-694x |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- rails (RubyGems) Vendor— Affected before 1.2.6 Fixed in 1.2.6 Patch available GHSA-p4c6-77gc-694x
CPE configurations NVD · 139
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:* | 0.9.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:* | 0.9.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:* | 0.9.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:* | 0.9.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:* | 0.9.4.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:* | 0.10.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:* | 0.10.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:* | 0.11.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:* | 0.11.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:* | 0.12.0 | Running on | Rails |
- cpe:2.3:a:rubyonrails:rails:0.9.1:*:*:*:*:*:*:* Versions 0.9.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.9.2:*:*:*:*:*:*:* Versions 0.9.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.9.3:*:*:*:*:*:*:* Versions 0.9.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.9.4:*:*:*:*:*:*:* Versions 0.9.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.9.4.1:*:*:*:*:*:*:* Versions 0.9.4.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.10.0:*:*:*:*:*:*:* Versions 0.10.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.10.1:*:*:*:*:*:*:* Versions 0.10.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.11.0:*:*:*:*:*:*:* Versions 0.11.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.11.1:*:*:*:*:*:*:* Versions 0.11.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.12.0:*:*:*:*:*:*:* Versions 0.12.0 Running on ·Rails
Show 129 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:* | 0.12.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:* | 0.13.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:* | 0.13.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:* | 0.14.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:* | 0.14.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:* | 0.14.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:* | 0.14.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:* | 1.0.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:* | 1.1.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:* | 1.1.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:* | 1.1.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:* | 1.1.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:* | 1.1.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:* | 1.1.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:* | 1.1.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:* | 1.2.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:* | 1.2.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:* | 1.2.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:* | 1.2.4 | Vulnerable | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:* | 1.2.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:* | 1.2.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:* | 1.9.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:* | 2.0.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:* | 2.0.0 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:* | 2.0.0 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:* | 2.0.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:* | 2.0.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:* | 2.1.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:* | 2.1.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:* | 2.2.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:* | 2.2.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:* | 2.2.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:* | 2.3.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:* | 2.3.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:* | 2.3.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:* | 2.3.9 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:* | 2.3.10 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:* | 2.3.11 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:* | 2.3.12 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* | 3.0.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* | 3.0.0 beta | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* | 3.0.0 beta3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* | 3.0.0 beta4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:* | 3.0.0 rc | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:* | 3.0.0 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:* | 3.0.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:* | 3.0.1 pre | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:* | 3.0.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:* | 3.0.2 pre | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:* | 3.0.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:* | 3.0.4 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:* | 3.0.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:* | 3.0.5 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:* | 3.0.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:* | 3.0.6 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:* | 3.0.6 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:* | 3.0.7 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:* | 3.0.7 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:* | 3.0.7 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:* | 3.0.8 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:* | 3.0.8 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:* | 3.0.8 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:* | 3.0.8 rc3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:* | 3.0.8 rc4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:* | 3.0.9 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:* | 3.0.9 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:* | 3.0.9 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:* | 3.0.9 rc3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:* | 3.0.9 rc4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:* | 3.0.9 rc5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:* | 3.0.10 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:* | 3.0.10 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:* | 3.0.11 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:* | 3.0.12 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:* | 3.0.12 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:* | 3.0.13 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:* | 3.0.13 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:* | 3.0.14 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* | 3.1.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:* | 3.1.0 beta1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:* | 3.1.0 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:* | 3.1.0 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:* | 3.1.0 rc3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:* | 3.1.0 rc4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:* | 3.1.0 rc5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:* | 3.1.0 rc6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:* | 3.1.0 rc7 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:* | 3.1.0 rc8 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:* | 3.1.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:* | 3.1.1 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:* | 3.1.1 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:* | 3.1.1 rc3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:* | 3.1.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:* | 3.1.2 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:* | 3.1.2 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:* | 3.1.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:* | 3.1.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:* | 3.1.4 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:* | 3.1.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:* | 3.1.5 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:* | 3.1.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* | 3.2.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* | 3.2.0 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:* | 3.2.0 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* | 3.2.1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* | 3.2.2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:* | 3.2.2 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* | 3.2.3 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:* | 3.2.3 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:* | 3.2.3 rc2 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* | 3.2.4 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:* | 3.2.4 rc1 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:* | 3.2.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:* | 3.2.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:* | 0.5.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:* | 0.5.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:* | 0.5.6 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:* | 0.5.7 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:* | 0.6.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:* | 0.6.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:* | 0.7.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:* | 0.8.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:* | 0.8.5 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:* | 0.9.0 | Running on | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:* | 3.0.4 | Running on | Rails |
- cpe:2.3:a:rubyonrails:rails:0.12.1:*:*:*:*:*:*:* Versions 0.12.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.13.0:*:*:*:*:*:*:* Versions 0.13.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.13.1:*:*:*:*:*:*:* Versions 0.13.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.14.1:*:*:*:*:*:*:* Versions 0.14.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.14.2:*:*:*:*:*:*:* Versions 0.14.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.14.3:*:*:*:*:*:*:* Versions 0.14.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:0.14.4:*:*:*:*:*:*:* Versions 0.14.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.0.0:*:*:*:*:*:*:* Versions 1.0.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.0:*:*:*:*:*:*:* Versions 1.1.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.1:*:*:*:*:*:*:* Versions 1.1.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.2:*:*:*:*:*:*:* Versions 1.1.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.3:*:*:*:*:*:*:* Versions 1.1.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.5:*:*:*:*:*:*:* Versions 1.1.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.1.6:*:*:*:*:*:*:* Versions 1.1.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.0:*:*:*:*:*:*:* Versions 1.2.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.2:*:*:*:*:*:*:* Versions 1.2.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.3:*:*:*:*:*:*:* Versions 1.2.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.4:*:*:*:*:*:*:* Versions 1.2.4 Vulnerable ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.5:*:*:*:*:*:*:* Versions 1.2.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.2.6:*:*:*:*:*:*:* Versions 1.2.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:1.9.5:*:*:*:*:*:*:* Versions 1.9.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc1:*:*:*:*:*:* Versions 2.0.0 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.0:rc2:*:*:*:*:*:* Versions 2.0.0 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.0.4:*:*:*:*:*:*:* Versions 2.0.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.1.0:*:*:*:*:*:*:* Versions 2.1.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.1.2:*:*:*:*:*:*:* Versions 2.1.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.2.0:*:*:*:*:*:*:* Versions 2.2.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.2.1:*:*:*:*:*:*:* Versions 2.2.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.2.2:*:*:*:*:*:*:* Versions 2.2.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:* Versions 3.0.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:* Versions 3.0.0 beta Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:* Versions 3.0.0 beta3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:* Versions 3.0.0 beta4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:* Versions 3.0.0 rc Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:* Versions 3.0.0 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:* Versions 3.0.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:* Versions 3.0.1 pre Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:* Versions 3.0.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:* Versions 3.0.2 pre Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:* Versions 3.0.4 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:* Versions 3.0.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:* Versions 3.0.5 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:* Versions 3.0.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:* Versions 3.0.6 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:* Versions 3.0.6 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:* Versions 3.0.7 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:* Versions 3.0.7 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:* Versions 3.0.7 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:* Versions 3.0.8 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:* Versions 3.0.8 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:* Versions 3.0.8 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:* Versions 3.0.8 rc3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:* Versions 3.0.8 rc4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:* Versions 3.0.9 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:* Versions 3.0.9 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:* Versions 3.0.9 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:* Versions 3.0.9 rc3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:* Versions 3.0.9 rc4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:* Versions 3.0.9 rc5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:* Versions 3.0.10 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:* Versions 3.0.10 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:* Versions 3.0.11 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:* Versions 3.0.12 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:* Versions 3.0.12 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:* Versions 3.0.13 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:* Versions 3.0.13 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:* Versions 3.0.14 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:* Versions 3.1.0 beta1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:* Versions 3.1.0 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:* Versions 3.1.0 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:* Versions 3.1.0 rc3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:* Versions 3.1.0 rc4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:* Versions 3.1.0 rc5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:* Versions 3.1.0 rc6 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:* Versions 3.1.0 rc7 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:* Versions 3.1.0 rc8 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:* Versions 3.1.1 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:* Versions 3.1.1 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:* Versions 3.1.1 rc3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:* Versions 3.1.2 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:* Versions 3.1.2 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:* Versions 3.1.4 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:* Versions 3.1.5 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* Versions 3.2.0 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:* Versions 3.2.0 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:* Versions 3.2.2 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:* Versions 3.2.3 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:* Versions 3.2.3 rc2 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:* Versions 3.2.4 rc1 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.0:*:*:*:*:*:*:* Versions 0.5.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.5:*:*:*:*:*:*:* Versions 0.5.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.6:*:*:*:*:*:*:* Versions 0.5.6 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.5.7:*:*:*:*:*:*:* Versions 0.5.7 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.0:*:*:*:*:*:*:* Versions 0.6.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.6.5:*:*:*:*:*:*:* Versions 0.6.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.7.0:*:*:*:*:*:*:* Versions 0.7.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.0:*:*:*:*:*:*:* Versions 0.8.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.8.5:*:*:*:*:*:*:* Versions 0.8.5 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:0.9.0:*:*:*:*:*:*:* Versions 0.9.0 Running on ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:* Versions 3.0.4 Running on ·Rails
Remediation
- Fix · GHSA-p4c6-77gc-694x rails (RubyGems) Fixed in 1.2.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2007-6077
- 2026-10-03 Alias added: GHSA-p4c6-77gc-694x
References
Advisory 6
Other 5
- http://dev.rubyonrails.org/changeset/8177
- http://docs.info.apple.com/article.html?artnum=307179
- http://weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-6077.yml
- https://rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
More Rails vulnerabilities
- TI-2014-00124 Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the… KEVCVSS 3.1HIGH 7.5
- TI-2019-03828 Path traversal in Rails https://github.com/rails/rails KEVCVSS 3.1HIGH 7.5
- TI-2016-00672 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x… KEVCVSS 3.1HIGH 7.5
- TI-2019-03830 Command injection in Rails https://github.com/rails/rails CVSS 3.1CRITICAL 9.8
- TI-2020-06581 Code injection in https://github.com/rails/rails CVSS 3.1HIGH 8.8
- TI-2013-00091 active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before… CVSS 2.0HIGH 7.5
Sources
- CVE-2007-6077 · CVE Program
- CVE-2007-6077 · NVD
- FIRST EPSS
- GHSA-p4c6-77gc-694x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences