{"id":"CVE-2020-8184","published":"2020-06-19T00:00:00Z","modified":"2024-08-04T09:56:26Z","title":"A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4…","vendor":null,"product":null,"tier":"tail","description":{"text":"A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02938,"percentile":0.87091,"provenance":"source"},"cwes":[{"id":"CWE-784","name":"Reliance on Cookies without Validation and Integrity Checking in a Security Decision"}],"references":[{"url":"https://hackerone.com/reports/895727","tags":[]},{"url":"https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak","tags":[]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00006.html","tags":["mailing-list"]},{"url":"https://usn.ubuntu.com/4561-1/","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/01/msg00038.html","tags":["mailing-list"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":17.42}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rack/rack","versions":["rack >= 2.2.3, rack >= 2.1.4"]}],"affected":[{"ecosystem":"RubyGems","package":"rack","vulnerableRanges":["<2.1.4",">=2.2.0, <2.2.3"],"patched":["2.1.4","2.2.3"],"from":["GHSA-j6w9-fv6q-3q52"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0494","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-rack-cve-2020-8184","children":[{"from":"CVE-2020-8184","to":"CVE-2024-26146","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/rack/utils.rb"],"commits":["https://github.com/rack/rack/commit/1f5763de6a9fe515ff84992b343d63c88104654c","https://github.com/rack/rack/commit/30b8e39a578b25d4bdcc082c1c52c6f164b59716","https://github.com/rack/rack/commit/6c5d90bdcec0949f7ba06db62fb740dab394b582"],"basis":"rarely changed file"}]},{"from":"CVE-2020-8184","to":"CVE-2020-7070","relation":"related","confidence":"low","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"See also CVE-2020-8184 for more information.","from":"CVE.org","in":"CVE-2020-7070"}]}]}}