CVSS 3.1
4.3 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NCVE-2020-8166
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Severity
- EPSS
- 1.7% chance of exploitation in the next 30 days; higher than 76% of CVEs (scores of 2026-10-31)
- CWE
- CWE-352
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- rubyonrails:rails
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-jp5v-5gx4-jmj9 | RubyGems | actionpack | >=5.0.0 <5.2.4.3 | 5.2.4.3 |
| GHSA-jp5v-5gx4-jmj9 | RubyGems | actionpack | >=6.0.0 <6.0.3.1 | 6.0.3.1 |