{"cve":"CVE-2021-29481","nvd":{"published":"2021-06-29T19:15:09.437","modified":"2026-06-17T03:47:43.877","status":"Modified","description":"Ratpack is a toolkit for creating web applications. In versions prior to 1.9.0, the default configuration of client side sessions results in unencrypted, but signed, data being set as cookie values. This means that if something sensitive goes into the session, it could be read by something with access to the cookies. For this to be a vulnerability, some kind of sensitive data would need to be stored in the session and the session cookie would have to leak. For example, the cookies are not configured with httpOnly and an adjacent XSS vulnerability within the site allowed capture of the cookies. As of version 1.9.0, a securely randomly generated signing key is used. As a workaround, one may supply an encryption key, as per the documentation recommendation.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5},"cwes":["CWE-312"],"references":["https://github.com/ratpack/ratpack/pull/1590","https://github.com/ratpack/ratpack/security/advisories/GHSA-phj8-4cq3-794g","https://github.com/ratpack/ratpack/pull/1590","https://github.com/ratpack/ratpack/security/advisories/GHSA-phj8-4cq3-794g"],"products":["ratpack_project:ratpack"],"source":"nvd","synced_at":"2026-10-19T21:20:07.141963181+00:00"},"epss":{"cve":"CVE-2021-29481","score":0.00455,"percentile":0.39539,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-phj8-4cq3-794g","url":"https://osv.dev/vulnerability/GHSA-phj8-4cq3-794g","summary":"Unencrypted storage of client side sessions","modified":"2026-07-08T06:27:38.203695856Z","packages":[{"ecosystem":"Maven","name":"io.ratpack:ratpack-session","purl":"pkg:maven/io.ratpack/ratpack-session","ranges":["<1.9.0"],"fixed":["1.9.0"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}