CVE-2020-8167

Опубликовано: 19 июн. 2020

Источник: nvd

CVSS3: 6.5

CVSS2: 4.3

EPSS Низкий

Описание

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

Ссылки

https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0
Mailing List
Patch
Third Party Advisory
https://hackerone.com/reports/189878
Exploit
Third Party Advisory
https://www.debian.org/security/2020/dsa-4766
Third Party Advisory
https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0
Mailing List
Patch
Third Party Advisory
https://hackerone.com/reports/189878
Exploit
Third Party Advisory
https://www.debian.org/security/2020/dsa-4766
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия до 5.2.4.3 (исключая)

cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*

Версия от 6.0.0 (включая) до 6.0.3.1 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00592

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352

Связанные уязвимости

CVE-2020-8167

CVSS3: 6.5

ubuntu

около 5 лет назад

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

CVE-2020-8167

CVSS3: 7.5

redhat

около 5 лет назад

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

CVE-2020-8167

CVSS3: 6.5

debian

около 5 лет назад

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that co ...

ROS-20250625-04

CVSS3: 6.5

redos

около 1 месяца назад

Уязвимость rubygem-actionview

GHSA-xq5j-gw7f-jgj8

CVSS3: 6.5

github

около 5 лет назад

CSRF Vulnerability in rails-ujs

EPSS

Процентиль: 68%

0.00592

Низкий

6.5 Medium

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-352