REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1820
Reference (s):
- BID:73295
- URL: http://www.securityfocus.com/bid/73295
- https://bugzilla.redhat.com/show_bug.cgi?id=1205291
- https://github.com/rest-client/rest-client/issues/369
- MLIST:[oss-security] 20150323 CVE-2015-1820: ruby rest-client session fixation vulnerability