Unscored severity · published Feb 8, 2013
CVE-2013-0263
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session…
–
CVSS
5.4%
EPSS
No
On KEV
Description
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rack · Rack Project
1.5.0; 1.5.1; 1.4.0; 1.4.1; 1.4.2; 1.4.3; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0263
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
Vendor Advisory
http://rack.github.com/
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0686.html
Vendor Advisory
http://secunia.com/advisories/52033
Vendor Advisory
http://secunia.com/advisories/52134
secunia.com
http://secunia.com/advisories/52774
More from Rack
10.0
CVE-2022-30123
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack
8.6
CVE-2020-8161
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack…
7.5
CVE-2022-30122
A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack
7.5
CVE-2020-8184
A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or…
7.5
CVE-2018-16470
There is a possible DoS vulnerability in the multipart parser in Rack before 2.0.6