Hi everyone
Hoping someone can help. Our website is scanned by Security Metrics and they have failed us on the last scan and we are no incompliant. I need to know what version Shopify are on at the moment with proof, can anyone help me get this information?
Title:
Ruby on Rails Multiple Method Session Fixation
Synopsis:
The remote web server is affected by a session fixation vulnerability.
Impact:
The web server on the remote host appears to be a version of Ruby on Rails that supports URL-based sessions. An unauthenticated, remote attacker may be able to leverage this issue to obtain an authenticated
session. Note that Ruby on Rails version 1.2.4 was initially supposed to address this issue, but its session fixation logic only works for the first request, when CgiRequest is first instantiated. See also :
http://www.nessus.org/u?d4902c46 http://www.nessus.org/u?d79d2646
http://www.nessus.org/u?abd8800d http://www.nessus.org/u?0bcaddc8
Resolution:
Upgrade to Ruby on Rails version 1.2.6 or later and make sure
‘config.action_controller.session_options[:cookie_only]’ is set to ‘true’ in
the ‘config/environment.rb’ file.
CVE Score Vector
CVE-2007-6077 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
CVE-2007-5380 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P