Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-gfy1-a8ds-p7dw
Vulnerability ID VCID-gfy1-a8ds-p7dw
Aliases CVE-2021-41263
GHSA-844m-cpr9-jcmh
Summary Rails Multisite secure/signed cookies share secrets between sites in a multi-site application
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (5)
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-565 Reliance on Cookies without Validation and Integrity Checking
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2021-41263
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2021-41263
epss 0.00198 https://api.first.org/data/v1/epss?cve=CVE-2021-41263
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-844m-cpr9-jcmh
cvssv3.1 6.2 https://github.com/discourse/rails_multisite
generic_textual MODERATE https://github.com/discourse/rails_multisite
cvssv3.1 6.2 https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
generic_textual MODERATE https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
cvssv3 6.2 https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
cvssv3.1 6.2 https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
cvssv3.1_qr MODERATE https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
generic_textual MODERATE https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
cvssv3.1 6.2 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml
cvssv3.1 6.2 https://nvd.nist.gov/vuln/detail/CVE-2021-41263
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2021-41263
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-41263
https://github.com/discourse/rails_multisite
https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
CVE-2021-41263 https://nvd.nist.gov/vuln/detail/CVE-2021-41263
CVE-2021-41263.YML https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml
GHSA-844m-cpr9-jcmh https://github.com/advisories/GHSA-844m-cpr9-jcmh
GHSA-844m-cpr9-jcmh https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H Found at https://github.com/discourse/rails_multisite
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H Found at https://github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H Found at https://github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rails_multisite/CVE-2021-41263.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41263
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.4176
EPSS Score 0.00198
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T20:27:08.577888+00:00 GHSA Importer Import https://github.com/advisories/GHSA-844m-cpr9-jcmh 38.6.0