CVE-2020-8165

Quick assessment

Copy summary Copy citation

Affected

n/a https://github.com/rails/rails

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Ruby on Rails是Rails团队的一套基于Ruby语言的开源Web应用框架。 Ruby on Rails 5.2.5之前版本和6.0.4之前版本中存在代码问题漏洞。攻击者可利用该漏洞将不受信任的Ruby对象注入到Web应用程序，执行代码或造成其他危害。

CVE-2020-8165 affects n/a https://github.com/rails/rails. Public or AI PoC available; prioritize validation. Ruby on Rails是Rails团队的一套基于Ruby语言的开源Web应用框架。 Ruby on Rails 5.2.5之前版本和6.0.4之前版本中存在代码问题漏洞。攻击者可利用该漏洞将不受信任的Ruby对象注入到Web应用程序，执行代码或造成其他危害。 CVE-2020-8165 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2020-8165

I. Basic Information for CVE-2020-8165

Affected Products

II. Public POCs for CVE-2020-8165

III. Intelligence Information for CVE-2020-8165

Mailing List Discussions for CVE-2020-8165 (4)

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html vendor-advisory x_refsource_SUSE
• https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html mailing-list x_refsource_MLIST
• https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html mailing-list x_refsource_MLIST

Security Blog Posts for CVE-2020-8165 (1)

• https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/ x_refsource_CONFIRM

Other References for CVE-2020-8165 (2)

• https://hackerone.com/reports/413388 x_refsource_MISC
• https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c x_refsource_MISC

• https://www.cve.org/CVERecord?id=CVE-2020-8165

Same Patch Batch · n/a · 2020-06-19 · 177 CVEs total

Showing top 20 of 177 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

V. Comments for CVE-2020-8165