RubySecRUBY:ACTIVERECORD-SESSION_STORE-2019-25025activerecord-session_store Timing Attack
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
65.0%
The activerecord-session_store (aka Active Record Session Store) component
through 1.1.3 for Ruby on Rails does not use a constant-time approach when delivering
information about whether a guessed session ID is valid. Consequently, remote attackers
can leverage timing discrepancies to achieve a correct guess in a relatively short
amount of time. This is a related issue to CVE-2019-16782.
Recommendation
Users should upgrade to activerecord-session_store version 2.0.0 or later.
Affected configurations
| Vendor | Product | Version | CPE |
|---|---|---|---|
| ruby | activerecord-session_store | * | cpe:2.3:a:ruby:activerecord-session_store:*:*:*:*:*:*:*:* |
Related
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
EPSS
Percentile
65.0%