A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Advisories
Source ID Title
Debian DSA Debian DSA DSA-4766-1 rails security update
EUVD EUVD EUVD-2020-0429 A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
Github GHSA Github GHSA GHSA-jp5v-5gx4-jmj9 Ability to forge per-form CSRF tokens in Rails
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2024-08-04T09:48:25.645Z

Reserved: 2020-01-28T00:00:00

Link: CVE-2020-8166

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2020-07-02T19:15:12.513

Modified: 2024-11-21T05:38:25.277

Link: CVE-2020-8166

cve-icon Redhat

Severity : Low

Publid Date: 2020-05-18T00:00:00Z

Links: CVE-2020-8166 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses