PT-2021-9093
CVE-2019-25025
·
تاريخ النشر
2021-03-05
·
تاريخ التحديث
2021-07-28
الوصف من
CVSS 3.1
5.3
متوسطةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions
activerecord-session store versions through 1.1.3
Description
The activerecord-session store component does not use a constant-time approach when delivering information about whether a guessed session ID is valid. Consequently, remote attackers can leverage timing discrepancies to achieve a correct guess in a relatively short amount of time.
Recommendations
For versions through 1.1.3, update to version 2.0.0 or later to resolve the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾