PT-2014-3266 · Juvia · Juvia

Stbuehler · Publicado 2014-04-29 · Atualizado 2014-04-29 · CVE-2013-7134

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Juvia (affected versions not specified)

Description The issue is related to Juvia using the same secret key for all installations. This allows remote attackers to have an unspecified impact by leveraging the secret key in the app/config/initializers/secret token.rb file, which is related to cookies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2013-7134

Produtos afetados

Juvia

Referências · 4

• https://github.com/phusion/juvia/issues/55 · Nota
• http://openwall.com/lists/oss-security/2013/12/16/3 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-7134 · Nota de Segurança
• http://openwall.com/lists/oss-security/2013/12/18/1 · Nota