RCE in Https://github.com/rails/rails
CVE-2020-8163
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.911 (99.7th percentile) — read the EPSS interpretation.
Affected products
- N/a Https://github.com/rails/rails — versions Fixed in 4.2.11.2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- hackerone.com/reports/304805 (x_refsource_MISC)
- groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0 (x_refsource_MISC)
- [debian-lts-announce] 20200720 [SECURITY] [DLA 2282-1] rails security update (mailing-list, x_refsource_MLIST)
- packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution… (x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-8163?
- CVE-2020-8163 is a vulnerability in Https://github.com/rails/rails, classified under Code Injection. Published 2020-07-02.
- Is CVE-2020-8163 known to be exploited?
- 40 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.