Fluid Attacks Database

Description

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
rubygems	rails	>=0 <5.2.4.3 \|\| >=6.0.0 <6.0.3.1	5.2.4.3, 6.0.3.1
rubygems	actionpack	>=5.0.0 <5.2.4.3 \|\| >=6.0.0 <6.0.3.1	5.2.4.3, 6.0.3.1
debian 12	rails	>=0 <2:5.2.4.3+dfsg-1	2:5.2.4.3+dfsg-1
debian 13	rails	>=0 <2:5.2.4.3+dfsg-1	2:5.2.4.3+dfsg-1
debian 14	rails	>=0 <2:5.2.4.3+dfsg-1	2:5.2.4.3+dfsg-1

Aliases

1. CVE-2020-81662. NVD-2020-81663. OSV-2020-81664. OSV-DEBIAN-2020-81665. GCVE-2020-81666. SECURITY-TRACKER-CVE-2020-8166

References

1. https://hackerone.com/reports/7324152. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml3. https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw4. https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw5. https://www.debian.org/security/2020/dsa-4766

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.