{"id":"CVE-2020-8166","published":"2020-07-02T18:35:17Z","modified":"2026-04-28T15:45:49Z","title":"A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a…","vendor":null,"product":null,"tier":"tail","description":{"text":"A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.01673,"percentile":0.7674,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://hackerone.com/reports/732415","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4766","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":18.4,"factors":[{"name":"EPSS percentile","points":15.35},{"name":"CVSS severity","points":3.01}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["Fixed in 5.2.4.3, 6.0.3.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=5.0.0, <5.2.4.3",">=6.0.0, <6.0.3.1"],"patched":["5.2.4.3","6.0.3.1"],"from":["GHSA-jp5v-5gx4-jmj9"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0429","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-0752","published":"2016-02-16","fixed":"4.2.5.1","kev":true},{"cve":"CVE-2016-2098","published":"2016-04-07","fixed":"4.2.5.2","kev":false},{"cve":"CVE-2020-8164","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2020-8185","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.1","toFixed":"6.0.3.2","daysApart":0}]}},{"cve":"CVE-2020-8264","published":"2021-01-06","fixed":"6.0.3.4","kev":false},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2021-22885","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"5.2.4.3","toFixed":"5.2.4.6","daysApart":329}]}},{"cve":"CVE-2021-22904","published":"2021-06-11","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2021-22904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"5.2.4.3","toFixed":"5.2.4.6","daysApart":344}]}}],"package":"RubyGems:actionpack"}}