CVE-2020-8184 | BDVDB-2026-137754 Detail

https://github.com/rack/rack

Description#

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Impact#

No impact statement in the source data.

Weaknesses#

CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision (CWE-784)

References#

https://hackerone.com/reports/895727
https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak
https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html
https://usn.ubuntu.com/4561-1/
https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html

Exploit#

No public exploit known

History#

Version 12020-06-19Record published in the CVE List.
Version 22024-08-04Most recent update recorded in the CVE List.