CVE-2015-1820: REST client for Ruby (aka rest-client) before 1.8.0 allows remote attackers to conduct session fixation att...

Security readout for executives and security teams

CVE-2015-1820 affects the Ruby rest-client library before 1.8.0. In some redirect handling, cookies from a server response could be passed onward, enabling session fixation or exposure of sensitive cookie data. This matters most for Ruby applications that used rest-client with authenticated web requests and redirects. Exposure is most likely in Ruby applications or services using rest-client versions earlier than 1.8.0 for HTTP workflows involving cookies and redirects. Risk is lower where rest-client is absent, upgraded, or not used for authenticated cookie-bearing requests. Prioritize remediation where Ruby services use rest-client for authenticated integrations. This is not shown as actively exploited in the provided sources, but cookie leakage or session fixation can affect account trust and partner integrations. Mitigation focus: Inventory Ruby projects and dependency locks for rest-client usage.; Upgrade rest-client to 1.8.0 or later where compatible.; Check vendor or distribution guidance for packaged Ruby environments..

Prepared

Jun 12, 2026, 21:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.