CVE-2013-0263

Published Feb 8, 2013

Last updated a month ago

Overview

Description
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Source
secalert@redhat.com
NVD status
Deferred

Risk scores

CVSS 2.0

Type
Primary
Base score
5.1
Impact score
6.4
Exploitability score
4.9
Vector string
AV:N/AC:H/Au:N/C:P/I:P/A:P

Weaknesses

nvd@nist.gov
NVD-CWE-noinfo

Social media

Hype score
Not currently trending

Configurations

References

Sources include official advisories and independent security research.