Staging Environment: Content and features may be unstable or change without notice.
Advisory details: ruby_advisory_db / gems/actionview/CVE-2020-8163
Advisory ID ruby_advisory_db/gems/actionview/CVE-2020-8163
Aliases CVE-2020-8163
GHSA-cr3x-7m39-c6jq
Summary Potential remote code execution of user-provided local names in ActionView There was a vulnerability in versions of Rails prior to 5.0.1 that would allow an attacker who controlled the `locals` argument of a `render` call. Versions Affected: rails < 5.0.1 Not affected: Applications that do not allow users to control the names of locals. Fixed Versions: 4.2.11.2 Impact ------ In the scenario where an attacker might be able to control the name of a local passed into `render`, they can acheive remote code execution. Workarounds ----------- Until such time as the patch can be applied, application developers should ensure that all user-provided local names are alphanumeric.
Status Published
Exploitability 0.5
Weighted Severity 0.0
Risk
Affected and Fixed Packages Package Details
Introduced and Fixed Package Commit Patches Package Commit Patches Details
Weaknesses (0)
There are no known CWE.
System Score Found at
cvssv3 8.8
Reference id Reference type URL
https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0
Data source Exploit-DB
Date added July 26, 2020
Description Rails 5.0.1 - Remote Code Execution
Ransomware campaign use Unknown
Source publication date July 26, 2020
Exploit type webapps
Platform ruby
Source update date July 26, 2020
Data source Exploit-DB
Date added July 26, 2020
Description Rails 5.0.1 - Remote Code Execution
Ransomware campaign use Unknown
Source publication date July 26, 2020
Exploit type webapps
Platform ruby
Source update date July 26, 2020

No EPSS data available for this advisory.

Patch URL
There are no known patches.

There are no known vectors.

There are no SSVC decisions available.