{"id":"CVE-2020-8164","published":"2020-06-19T17:04:13Z","modified":"2024-08-04T09:48:25Z","title":"A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an…","vendor":null,"product":null,"tier":"tail","description":{"text":"A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.04889,"percentile":0.92015,"provenance":"source"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"https://hackerone.com/reports/292797","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY","tags":["x_refsource_MISC"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://www.debian.org/security/2020/dsa-4766","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html","tags":["vendor-advisory","x_refsource_SUSE"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":18.4}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["5.2.4.3, 6.0.3.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=5.0.0, <5.2.4.3",">=6.0.0, <6.0.3.1"],"patched":["5.2.4.3","6.0.3.1"],"from":["GHSA-8727-m6gj-mc37"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0416","exploited":false,"provenance":"source"}}