medium4.3
CVE-2020-8166
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one presen…
Impact
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Rubyonrails | Rails | before 5.2.4.3 from 6.0.0 before 6.0.3.1 |
| Debian | Debian Linux | Version 10.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
- https://hackerone.com/reports/732415
- https://www.debian.org/security/2020/dsa-4766
- https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
- https://hackerone.com/reports/732415
- https://www.debian.org/security/2020/dsa-4766
- https://hackerone.com/reports/732415