CVE-2007-6077
session fixation protection mechanism in cgi_process.rb in Rails
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
Exploit likelihood
What each source reports
NVD Score used
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
CVE-2007-6077- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE List No score
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
CVE-2007-6077- Updated
- 2026-11-02
EUVDEUVD-2017-0277 No score
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
EUVD-2017-0277- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p4c6-77gc-694x No score
session fixation protection mechanism in cgi_process.rb in Rails
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
GHSA-p4c6-77gc-694x- Weakness
- CWE-362
- Updated
- 2026-11-02
OSV No score
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
CVE-2007-6077- Updated
- 2026-11-02
OSVDEBIAN-CVE-2007-6077 No score
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
DEBIAN-CVE-2007-6077- Updated
- 2026-11-02
OSVGHSA-p4c6-77gc-694x No score
session fixation protection mechanism in cgi_process.rb in Rails
The session fixation protection mechanism in cgi_process.rb in Rails 1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute from the DEFAULT_SESSION_OPTIONS constant, which effectively causes cookie_only to be applied only to the first instantiation of CgiRequest, which allows remote attackers to conduct session fixation attacks. NOTE: this is due to an incomplete fix for CVE-2007-5380.
- Record
GHSA-p4c6-77gc-694x- Weakness
- CWE-362
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
railsRubyGems |
before 1.2.6 | 1.2.6 |
railsDebian:12 |
before 1.2.6-1 | 1.2.6-1 |
railsDebian:13 |
before 1.2.6-1 | 1.2.6-1 |
railsDebian:14 |
before 1.2.6-1 | 1.2.6-1 |
railsRubyGems |
before 1.2.6, plus listed versions 0.10.00.10.10.11.00.11.10.12.0 Show 30 moreShow less0.12.10.13.00.13.10.14.10.14.20.14.30.14.40.8.00.8.50.9.00.9.10.9.20.9.30.9.40.9.4.10.9.51.0.01.1.01.1.11.1.21.1.31.1.41.1.51.1.61.2.01.2.11.2.21.2.31.2.41.2.5 |
1.2.6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| affected, aliases, facts, references, title | GitHub Advisories, OSV | |
| first indexed | CVE List, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2007-6077 is a medium vulnerability (CVSS 6.8) in Rubyonrails Rails, published November 21, 2007. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.51%, the 84th percentile. Fixed in rails 1.2.6.
References
vupen.com/english/advisories/2007/4238
us-cert.gov/cas/techalerts/TA07-352A.html
secunia.com/advisories/28136
dev.rubyonrails.org/changeset/8177
lists.apple.com/archives/security-announce/2007/Dec/msg00002.html
Show 10 moreShow less
securityfocus.com/bid/26598
docs.info.apple.com/article.html?artnum=307179
weblog.rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
nvd.nist.gov/vuln/detail/CVE-2007-6077
github.com/advisories/GHSA-p4c6-77gc-694x
rubyonrails.org/2007/11/24/ruby-on-rails-1-2-6-security-and-maintenance-release
security-tracker.debian.org/tracker/CVE-2007-6077