admin/cve
1
0
Fork 0
mirror of https://github.com/0xMarcio/cve.git synced 2025-06-19 17:30:12 +00:00
Code Issues Packages Projects Releases Wiki Activity
cve/2024/CVE-2024-26144.md
0xMarcio d6bcaa53f2 Update CVE sources 2024-07-25 21:25
2024-07-25 21:25:12 +00:00

1.0 KiB
Raw Blame History

CVE-2024-26144

Description

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

POC

Reference

No PoCs from references.

Github