CVE - CVE-2024-26144

CVE-ID
CVE-2024-26144	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
CONFIRM:https://security.netapp.com/advisory/ntap-20240510-0013/ MISC:https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945 URL:https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945 MISC:https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433 URL:https://github.com/rails/rails/commit/723f54566023e91060a67b03353e7c03e7436433 MISC:https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3 URL:https://github.com/rails/rails/commit/78fe149509fac5b05e54187aaaef216fbb5fd0d3 MISC:https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g URL:https://github.com/rails/rails/security/advisories/GHSA-8h22-8cf7-hq6g MISC:https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml URL:https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activestorage/CVE-2024-26144.yml
Assigning CNA
GitHub (maintainer security advisories)
Date Record Created
20240214	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240214)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)