Loading...
Skip to main content
GeekWala

CVE-2021-41263 — Vulnerability in rails_multisite — CVE Details

MEDIUM

Rails Multisite secure/signed cookies share secrets between sites in a multi-site application

Published November 15, 2021Updated July 8, 2026Source: osv

Summary

### Impact This vulnerability impacts any Rails applications using `rails_multisite` alongside Rails' signed/encrypted cookies. Depending on how the application makes use of these cookies, it may be possible for an attacker to re-use cookies on different 'sites' within a multi-site Rails application. ### Patches The issue has been patched in v4 of the `rails_multisite` gem. Note that this upgrade will invalidate all previous signed/encrypted cookies. The impact of this invalidation will vary based on the application architecture.

Advisory Timeline

  • First published November 15, 2021 (1792 days ago).
  • Last revised July 8, 2026 — 1696 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Bundler
Update rails_multisite to 4.0.0 or later
gem install rails_multisite -v 4.0.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: rubygems (1).

PackageEcosystemAffectedFixed In
rails_multisite
rubygems
0.0.1, 1.0.1, 1.0.2, 1.0.3 (+24 more)4.0.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.2 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H

References

Frequently Asked Questions

What is CVE-2021-41263?
Rails Multisite secure/signed cookies share secrets between sites in a multi-site application This vulnerability has been assigned a severity rating of MEDIUM (CVSS score: 6.2/10).
How do I check if my project is affected by CVE-2021-41263?
CVE-2021-41263 affects rails_multisite. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2021-41263 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.2

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-844m-cpr9-jcmh

Related CVEs

More RubyGems advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies