Threats tagged 'ghsa-x6mj-8jx9-qhqv'

A vulnerability in Action Pack's Active Storage proxy mode can cause sensitive session information leakage when cookies are rotated or migrated using a hybrid serializer. This occurs because the session cookie is rewritten on cacheable responses despite session skipping options, potentially exposing user sessions via shared caches. The issue affects applications serving Active Storage files through proxy controllers with cookie rotation or hybrid serializer migration configured and using caches that store Set-Cookie headers on public responses. Fixed versions are available.