Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-w33m-yjha-ckap
Vulnerability ID VCID-w33m-yjha-ckap
Aliases CVE-2015-1820
GHSA-3fhf-6939-qg8p
OSV-119878
Summary rest-client Gem Vulnerable to Session Fixation REST client for Ruby (aka rest-client) versions 1.6.1.a until 1.8.0 allow remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging passage of cookies set in a response to a redirect.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-384 Session Fixation
CWE-201 Insertion of Sensitive Information Into Sent Data
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.03723 https://api.first.org/data/v1/epss?cve=CVE-2015-1820
cvssv3.1 9.8 https://bugzilla.redhat.com/show_bug.cgi?id=1205291
generic_textual CRITICAL https://bugzilla.redhat.com/show_bug.cgi?id=1205291
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-3fhf-6939-qg8p
cvssv3.1 9.8 https://github.com/rest-client/rest-client
generic_textual CRITICAL https://github.com/rest-client/rest-client
cvssv3 9.8 https://github.com/rest-client/rest-client/issues/369
cvssv3.1 9.8 https://github.com/rest-client/rest-client/issues/369
generic_textual CRITICAL https://github.com/rest-client/rest-client/issues/369
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2015-1820
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2015-1820
cvssv3.1 9.8 https://rubygems.org/gems/rest-client/versions/1.6.1.a
generic_textual CRITICAL https://rubygems.org/gems/rest-client/versions/1.6.1.a
cvssv3.1 9.8 https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
generic_textual CRITICAL https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
cvssv3.1 9.8 http://www.openwall.com/lists/oss-security/2015/03/24/3
generic_textual CRITICAL http://www.openwall.com/lists/oss-security/2015/03/24/3
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2015-1820.json
https://api.first.org/data/v1/epss?cve=CVE-2015-1820
https://bugzilla.redhat.com/show_bug.cgi?id=1205291
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1820
https://github.com/rest-client/rest-client
https://github.com/rest-client/rest-client/issues/369
https://nvd.nist.gov/vuln/detail/CVE-2015-1820
https://rubygems.org/gems/rest-client/versions/1.6.1.a
https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
http://www.openwall.com/lists/oss-security/2015/03/24/3
781238 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=781238
GHSA-3fhf-6939-qg8p https://github.com/advisories/GHSA-3fhf-6939-qg8p
RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=1205291
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rest-client/rest-client
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/rest-client/rest-client/issues/369
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2015-1820
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://rubygems.org/gems/rest-client/versions/1.6.1.a
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://web.archive.org/web/20200228080106/http://www.securityfocus.com/bid/73295
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at http://www.openwall.com/lists/oss-security/2015/03/24/3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.8818
EPSS Score 0.03723
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:19:38.673955+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/08/GHSA-3fhf-6939-qg8p/GHSA-3fhf-6939-qg8p.json 38.6.0