The FileStore capability in CGI::Session for Ruby before 1.8.1, and possibly PStore, creates files with insecure permissions, which can allow local users to steal session information and hijack sessions.
Name | Vendor | Start Version | End Version |
---|---|---|---|
Ruby | Yukihiro_matsumoto | 1.6 | 1.6 |
Ruby | Yukihiro_matsumoto | 1.8 | 1.8 |