Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Ruby on Rails Vulnerability - CVE-2024-26144 - Vulnerability Database
Ruby on Rails

Ruby on Rails Vulnerability - CVE-2024-26144

Medium
Reference: CVE-2024-26144
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2024-26144
Title: Ruby on Rails Vulnerability
Overview:

Rails is a web-application framework. Starting with version 5.2.0 there is a possible sensitive session information leak in Active Storage. By default Active Storage sends a Set-Cookie header along with the user39s session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.