CVE-2024-26144

Summary

CVE-2024-26144: Starting from Rails version 5.2.0, there's a potential sensitive session information leak in Active Storage. By default, Active Storage transmits a Set-Cookie header with user sessions when delivering blobs. Additionally, it sets Cache-Control to public. Some proxies may cache the Set-Cookie, resulting in information disclosure. This vulnerability is resolved in versions 7.0.8.1 and 6.1.7.7.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.