CVE-2020-8164 | BDVDB-2026-137751 Detail
https://github.com/rails/rails
Description#
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
Impact#
No impact statement in the source data.
Weaknesses#
- CWE-502 Deserialization of Untrusted Data
References#
- https://hackerone.com/reports/292797
- https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY
- https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- https://www.debian.org/security/2020/dsa-4766
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.