PT-2014-3266 · Juvia · Juvia

Stbuehler · Published 2014-04-29 · Updated 2014-04-29 · CVE-2013-7134

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Juvia (affected versions not specified)

Description The issue is related to Juvia using the same secret key for all installations. This allows remote attackers to have an unspecified impact by leveraging the secret key in the app/config/initializers/secret token.rb file, which is related to cookies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-7134

Affected Products

Juvia

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2013-7134 · Security Note
• https://github.com/phusion/juvia/issues/55 · Note
• http://openwall.com/lists/oss-security/2013/12/16/3 · Note
• http://openwall.com/lists/oss-security/2013/12/18/1 · Note