cve.bz

CVE-2020-8165

9.8 criticalEPSS 46%

Critical (9.8). EPSS 46% chance of exploitation in the next 30 days. Fixed in activesupport 5.2.4.3, 6.0.3.1.

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Severity

CVSS 3.1

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
46% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-502
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-2p68-f74v-9wc6RubyGemsactivesupport>=5.0.0 <5.2.4.35.2.4.3
GHSA-2p68-f74v-9wc6RubyGemsactivesupport>=6.0.0 <6.0.3.16.0.3.1

References

Check your stackJSON