Unscored CVE-2013-7134 EUVD-2013-6917GHSA-83r6-2qgv-m5qp

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key…

Published Apr 29, 2014 · Updated Aug 6, 2024 · Assigned by mitre

Description

Juvia uses the same secret key for all installations, which allows remote attackers to have unspecified impact by leveraging the secret key in app/config/initializers/secret_token.rb, related to cookies.

References

https://github.com/phusion/juvia/issues/55
[oss-security] 20131216 CVE request: Juvia secret token handling mailing-list
[oss-security] 20131217 Re: CVE request: Juvia secret token handling mailing-list