I think the CVE description is inaccurate in this case. Check out the Rails security email list description, which never mentions sessions. https://groups.goog

I think the CVE description is inaccurate in this case. Check out the Rails security email list description, which never mentions sessions. https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...