Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-5t76-mwx9-8kc8
Vulnerability ID VCID-5t76-mwx9-8kc8
Aliases CVE-2020-8166
GHSA-jp5v-5gx4-jmj9
Summary Ability to forge per-form CSRF tokens in Rails It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session. Impact ------ Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session. Workarounds ----------- This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-352 Cross-Site Request Forgery (CSRF)
System Score Found at
cvssv3 3.7 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8166.json
epss 0.00443 https://api.first.org/data/v1/epss?cve=CVE-2020-8166
cvssv3.1 3.7 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-jp5v-5gx4-jmj9
cvssv3.1 4.3 https://github.com/rails/rails
generic_textual MODERATE https://github.com/rails/rails
cvssv3.1 4.3 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml
generic_textual MODERATE https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml
cvssv3 4.3 https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
cvssv3.1 4.3 https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
generic_textual MODERATE https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
cvssv3.1 4.3 https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
generic_textual MODERATE https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
ssvc Track https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
cvssv3.1 4.3 https://hackerone.com/reports/732415
generic_textual MODERATE https://hackerone.com/reports/732415
ssvc Track https://hackerone.com/reports/732415
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2020-8166
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2020-8166
cvssv3.1 4.3 https://www.debian.org/security/2020/dsa-4766
generic_textual MODERATE https://www.debian.org/security/2020/dsa-4766
ssvc Track https://www.debian.org/security/2020/dsa-4766
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8166.json
https://api.first.org/data/v1/epss?cve=CVE-2020-8166
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15169
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8162
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8164
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8165
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8166
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8167
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/rails/rails
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml
https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
https://hackerone.com/reports/732415
https://nvd.nist.gov/vuln/detail/CVE-2020-8166
https://www.debian.org/security/2020/dsa-4766
1843152 https://bugzilla.redhat.com/show_bug.cgi?id=1843152
GHSA-jp5v-5gx4-jmj9 https://github.com/advisories/GHSA-jp5v-5gx4-jmj9
RHSA-2021:1313 https://access.redhat.com/errata/RHSA-2021:1313
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2020-8166.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/rails/rails
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-28T15:45:41Z/ Found at https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://hackerone.com/reports/732415
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-28T15:45:41Z/ Found at https://hackerone.com/reports/732415
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2020-8166
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Found at https://www.debian.org/security/2020/dsa-4766
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-28T15:45:41Z/ Found at https://www.debian.org/security/2020/dsa-4766
Exploit Prediction Scoring System (EPSS)
Percentile 0.63589
EPSS Score 0.00443
Published At May 29, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-29T09:11:58.901219+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-jp5v-5gx4-jmj9/GHSA-jp5v-5gx4-jmj9.json 38.6.0