Unscored severity · published Feb 8, 2013
CVE-2013-0263
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session…
–
CVSS
5.4%
EPSS
No
On KEV
Description
Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.4% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RA
Rack · Rack Project
1.5.0; 1.5.1; 1.4.0; 1.4.1; 1.4.2; 1.4.3; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-0263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-0263
lists.opensuse.org
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
Vendor Advisory
http://rack.github.com/
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0686.html
Vendor Advisory
http://secunia.com/advisories/52033
Vendor Advisory
http://secunia.com/advisories/52134
secunia.com
http://secunia.com/advisories/52774
More from Rack
10.0
CVE-2022-30123
A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack
8.6
CVE-2020-8161
A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack…
7.5
CVE-2024-26141
Possible DoS Vulnerability with Range Header in Rack
7.5
CVE-2024-25126
Rack ReDos in content type parsing (2nd degree polynomial)
7.5
CVE-2024-26146
Possible Denial of Service Vulnerability in Rack Header Parsing