PT-2020-5644 · Ruby+6 · Rack+6
Published
2020-06-19
·
Updated
2026-03-13
·
CVE-2020-8184
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Name of the Vulnerable Software and Affected Versions
rack versions prior to 2.2.3
rack versions prior to 2.1.4
Description
A security issue exists due to a reliance on cookies without proper validation or integrity checks, making it possible for an attacker to forge a secure or host-only cookie prefix. This vulnerability is related to the
parse cookies header function in the utils.rb module, which lacks sufficient input validation mechanisms. Exploitation of this issue may allow a remote attacker to impact data integrity.Recommendations
For versions prior to 2.2.3, update to version 2.2.3 or later.
For versions prior to 2.1.4, update to version 2.1.4 or later.
As a temporary workaround, consider implementing additional validation or integrity checks for cookies to minimize the risk of exploitation.
Exploit
Fix
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Linuxmint
Red Os
Suse
Ubuntu
Rack