Vulnerability Database

289,697

Total vulnerabilities in the database

CVE-2013-0263

Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.

CVSS v2:

  • Severity: Medium
  • Score: 5.1
  • AV:N/AC:H/Au:N/C:P/I:P/A:P

No CWE or OWASP classifications available.

Software From Fixed in
rack_project / rack 1.5.1 1.5.1.x
rack_project / rack 1.5.0 1.5.0.x
rack_project / rack 1.4.4 1.4.4.x
rack_project / rack 1.4.2 1.4.2.x
rack_project / rack 1.4.3 1.4.3.x
rack_project / rack 1.4.0 1.4.0.x
rack_project / rack 1.4.1 1.4.1.x
rack_project / rack 1.3.1 1.3.1.x
rack_project / rack 1.3.7 1.3.7.x
rack_project / rack 1.3.8 1.3.8.x
rack_project / rack 1.3.2 1.3.2.x
rack_project / rack 1.3.5 1.3.5.x
rack_project / rack 1.3.9 1.3.9.x
rack_project / rack 1.3.6 1.3.6.x
rack_project / rack 1.3.0 1.3.0.x
rack_project / rack 1.3.4 1.3.4.x
rack_project / rack 1.3.3 1.3.3.x
rack_project / rack 1.2.6 1.2.6.x
rack_project / rack 1.2.3 1.2.3.x
rack_project / rack 1.2.0 1.2.0.x
rack_project / rack 1.2.7 1.2.7.x
rack_project / rack 1.2.1 1.2.1.x
rack_project / rack 1.2.4 1.2.4.x
rack_project / rack 1.2.2 1.2.2.x
rack_project / rack 1.1.0 1.1.0.x
rack_project / rack 1.1.4 1.1.4.x
rack_project / rack 1.1.5 1.1.5.x
rack_project / rack 1.1.6 1.1.6.x
rack 1.5.0 1.5.2
rack 1.4.0 1.4.5
rack 1.3.0 1.3.10
rack 1.2.0 1.2.8
rack 1.1.0 1.1.6