Moderate severityNVD Advisory· Published Oct 19, 2007· Updated Jun 16, 2026
CVE-2007-5380
CVE-2007-5380
Description
Session fixation vulnerability in Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers to hijack web sessions via unspecified vectors related to "URL-based sessions."
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
railsRubyGems | < 1.2.4 | 1.2.4 |
Affected products
2Patches
Vulnerability mechanics
References
16- www.securityfocus.com/bid/26096nvdPatchWEB
- github.com/advisories/GHSA-jwhv-rgqc-fqj5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2007-5380ghsaADVISORY
- bugs.gentoo.org/show_bug.cginvdWEB
- docs.info.apple.com/article.htmlnvdWEB
- lists.apple.com/archives/security-announce/2007/Dec/msg00002.htmlnvdWEB
- secunia.com/advisories/27657nvdWEB
- secunia.com/advisories/27965nvdWEB
- secunia.com/advisories/28136nvdWEB
- security.gentoo.org/glsa/glsa-200711-17.xmlnvdWEB
- weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-releasenvdWEB
- www.novell.com/linux/security/advisories/2007_25_sr.htmlnvdWEB
- www.us-cert.gov/cas/techalerts/TA07-352A.htmlnvdUS Government ResourceWEB
- www.vupen.com/english/advisories/2007/3508nvdWEB
- www.vupen.com/english/advisories/2007/4238nvdWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5380.ymlghsaWEB
News mentions
0No linked articles in our index yet.