VulnerableCode Package Details - pkg:gem/rails@6.1.7.2

Search for packages

Vulnerability	Summary	Fixed by
VCID-65tq-e5eb-eucj Aliases: CVE-2024-26144 GHSA-8h22-8cf7-hq6g	Rails has possible Sensitive Session Information Leak in Active Storage # Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a `Set-Cookie` header along with the user's session cookie when serving blobs. It also sets `Cache-Control` to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This vulnerability has been assigned the CVE identifier CVE-2024-26144. Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7 Impact ------ A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa. This was patched in 7.1.0 but not previously identified as a security vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Upgrade to Rails 7.1.X, or configure caching proxies not to cache the Set-Cookie headers. Credits ------- Thanks to [tyage](https://hackerone.com/tyage) for reporting this!	6.1.7.7 Affected by 0 other vulnerabilities. 7.0.8.1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-65tq-e5eb-eucj
Aliases:
CVE-2024-26144
GHSA-8h22-8cf7-hq6g

Rails has possible Sensitive Session Information Leak in Active Storage # Possible Sensitive Session Information Leak in Active Storage There is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a `Set-Cookie` header along with the user's session cookie when serving blobs. It also sets `Cache-Control` to public. Certain proxies may cache the Set-Cookie, leading to an information leak. This vulnerability has been assigned the CVE identifier CVE-2024-26144. Versions Affected: >= 5.2.0, < 7.1.0 Not affected: < 5.2.0, > 7.1.0 Fixed Versions: 7.0.8.1, 6.1.7.7 Impact ------ A proxy which chooses to caches this request can cause users to share sessions. This may include a user receiving an attacker's session or vice versa. This was patched in 7.1.0 but not previously identified as a security vulnerability. All users running an affected release should either upgrade or use one of the workarounds immediately. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Upgrade to Rails 7.1.X, or configure caching proxies not to cache the Set-Cookie headers. Credits ------- Thanks to [tyage](https://hackerone.com/tyage) for reporting this!

6.1.7.7
Affected by 0 other vulnerabilities.

7.0.8.1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T22:52:39.709585+00:00	GitLab Importer	Affected by	VCID-65tq-e5eb-eucj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2024-26144.yml	38.4.0
2026-04-12T00:11:15.940843+00:00	GitLab Importer	Affected by	VCID-65tq-e5eb-eucj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2024-26144.yml	38.3.0
2026-04-03T00:17:16.867586+00:00	GitLab Importer	Affected by	VCID-65tq-e5eb-eucj	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/gem/rails/CVE-2024-26144.yml	38.1.0