PT-2017-6522 · Unknown · Rest-Client

Ab · Publicado 2015-05-15 · Atualizado 2018-08-13 · CVE-2015-1820

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions rest-client versions 1.6.1.a through 1.8.0

Description The issue allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.

Recommendations For versions 1.6.1.a through 1.7.x, update to version 1.8.0 or later to resolve the issue. For version 1.8.0, ensure you have the latest patch or update to prevent exploitation.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2015-1820

GHSA-3FHF-6939-QG8P

MGASA-2015-0227

RHSA-2021:1313

Produtos afetados

Rest-Client

Referências · 20

• https://github.com/rest-client/rest-client/issues/369 · Nota
• https://github.com/rest-client/rest-client · Nota
• https://github.com/rest-client/rest-client/blob/master/history.md · Nota
• https://web.archive.org/web/20200228080106/http://securityfocus.com/bid/73295 · Nota
• http://openwall.com/lists/oss-security/2015/03/24/3 · Nota
• https://osv.dev/vulnerability/GHSA-3fhf-6939-qg8p · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-1820 · Nota de Segurança
• https://osv.dev/vulnerability/MGASA-2015-0227 · Aviso do Fabricante
• https://rubygems.org/gems/rest-client/versions/1.6.1.a · Nota
• https://advisories.mageia.org/MGASA-2015-0227.html · Nota de Segurança
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-1820 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-1820 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=15560 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-1820 · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-updates/2015-04/msg00026.html · Nota