{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-19T10:30:40.248","vulnerabilities":[{"cve":{"id":"CVE-2021-29480","sourceIdentifier":"security-advisories@github.com","published":"2021-06-29T19:15:09.340","lastModified":"2024-11-21T06:01:13.587","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the client side session module uses the application startup time as the signing key by default. This means that if an attacker can determine this time, and if encryption is not also used (which is recommended, but is not on by default), the session data could be tampered with by someone with the ability to write cookies. The default configuration is unsuitable for production use as an application restart renders all sessions invalid and is not multi-host compatible, but its use is not actively prevented. As of Ratpack 1.9.0, the default value is a securely randomly generated value, generated at application startup time. As a workaround, supply an alternative signing key, as per the documentation's recommendation."},{"lang":"es","value":"Ratpack es un kit de herramientas para crear aplicaciones web. En las versiones anteriores a 1.9.0, el módulo de sesión del lado del cliente usa por defecto la hora de inicio de la aplicación como clave de firma. Esto significa que si un atacante puede determinar esta hora, y si no se usa también el cifrado (que se recomienda, pero no está activado por defecto), los datos de la sesión podrían ser manipulados por alguien con la capacidad de escribir cookies. La configuración por defecto es inapropiada para su uso en producción, ya que un reinicio de la aplicación invalida todas las sesiones y no es compatible con varios hosts, pero no se impide activamente su uso. A partir de Ratpack versión 1.9.0, el valor por defecto es un valor generado aleatoriamente de forma segura, generado en el momento de iniciar la aplicación. Como solución, proporcione una clave de firma alternativa, según la recomendación de la documentación"}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","baseScore":4.4,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":2.5},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N","baseScore":3.1,"baseSeverity":"LOW","attackVector":"NETWORK","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":1.4}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-340"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-330"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:ratpack_project:ratpack:*:*:*:*:*:*:*:*","versionEndExcluding":"1.9.0","matchCriteriaId":"E972830A-9822-4DD9-BB64-9CC2B69018D5"}]}]}],"references":[{"url":"https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/ratpack/ratpack/security/advisories/GHSA-2cc5-23r7-vc4v","source":"security-advisories@github.com","tags":["Third Party Advisory"]},{"url":"https://github.com/ratpack/ratpack/blob/29434f7ac6fd4b36a4495429b70f4c8163100332/ratpack-session/src/main/java/ratpack/session/clientside/ClientSideSessionConfig.java#L29","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]},{"url":"https://github.com/ratpack/ratpack/security/advisories/GHSA-2cc5-23r7-vc4v","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"]}]}}]}