Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-vhdm-w6p1-uuh9
Vulnerability ID VCID-vhdm-w6p1-uuh9
Aliases CVE-2015-1820
GHSA-3fhf-6939-qg8p
OSV-119878
Summary Session fixation vulnerability via Set-Cookie headers The package rest-client in `abstract_response.rb` improperly handles `Set-Cookie` headers on HTTP redirection responses. Any cookies will be forwarded to the redirection target regardless of domain, path, or expiration. If you control a redirection source, you can cause rest-client to perform a request to any third-party domain with cookies of your choosing, which may be useful in performing a session fixation attack. If you control a redirection target, you can steal any cookies set by the third-party redirection request.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-384 Session Fixation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-201 Insertion of Sensitive Information Into Sent Data
System Score Found at
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
cvssv3.1 9.8 https://bugzilla.redhat.com/show_bug.cgi?id=1205291
generic_textual CRITICAL https://bugzilla.redhat.com/show_bug.cgi?id=1205291
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-3fhf-6939-qg8p
cvssv3.1 9.8 https://github.com/rest-client/rest-client
generic_textual CRITICAL https://github.com/rest-client/rest-client
cvssv3 9.8 https://github.com/rest-client/rest-client/issues/369
cvssv3.1 9.8 https://github.com/rest-client/rest-client/issues/369
generic_textual CRITICAL https://github.com/rest-client/rest-client/issues/369
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2015-1820
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2015-1820
cvssv3.1 9.8 https://rubygems.org/gems/rest-client/versions/1.6.1.a
generic_textual CRITICAL https://rubygems.org/gems/rest-client/versions/1.6.1.a
cvssv3.1 9.8 https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
generic_textual CRITICAL https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2015/03/24/3
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2015/03/24/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1820.json
https://api.first.org/data/v1/epss?cve=CVE-2015-1820
https://bugzilla.redhat.com/show_bug.cgi?id=1205291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1820
https://github.com/rest-client/rest-client
https://github.com/rest-client/rest-client/issues/369
https://nvd.nist.gov/vuln/detail/CVE-2015-1820
https://rubygems.org/gems/rest-client/versions/1.6.1.a
https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
http://www.openwall.com/lists/oss-security/2015/03/24/3
781238 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781238
GHSA-3fhf-6939-qg8p https://github.com/advisories/GHSA-3fhf-6939-qg8p
RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1205291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rest-client/rest-client
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rest-client/rest-client/issues/369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2015-1820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://rubygems.org/gems/rest-client/versions/1.6.1.a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2015/03/24/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.87929
EPSS Score 0.03723
Published At April 1, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-01T12:47:17.939950+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rest-client/CVE-2015-1820.yml 38.0.0