CVE-2021-41263: Exposure of Sensitive Information to an Unauthorized Actor

November 15, 2021 (updated August 9, 2022)

rails_multisite provides multi-db support for Rails applications.Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different ‘sites’ within a multi-site Rails application. The issue has been patched in v4 of the rails_multisite gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.

References

github.com/discourse/rails_multisite/commit/c6785cdb5c9277dd2c5ac8d55180dd1ece440ed0
github.com/discourse/rails_multisite/security/advisories/GHSA-844m-cpr9-jcmh
nvd.nist.gov/vuln/detail/CVE-2021-41263

Code Behaviors & Features

Detect and mitigate CVE-2021-41263 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →