Description

A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

Remediation

References

CVE-2009-3086

Related Vulnerabilities

WordPress Plugin MWB Point of Sale (POS) for WooCommerce-Generate Barcodes, Process your Bills, Synchronize, Your Online-Offline Orders Cross-Site Request Forgery (1.0.0)

WordPress Plugin Import CSV Directory Traversal (1.0)

WordPress Plugin Arlo training and event management system Cross-Site Scripting (2.1.7.1)

PHP Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-3065)

EspoCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14349)

Severity

Medium

Classification

CVE-2009-3086 CWE-200

Tags

Missing Update Known Vulnerabilities