{"id":"CVE-2020-8167","published":"2020-06-19T17:16:06Z","modified":"2024-08-04T09:48:25Z","title":"A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong…","vendor":null,"product":null,"tier":"tail","description":{"text":"A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.01485,"percentile":0.73918,"provenance":"source"},"cwes":[{"id":"CWE-352","name":"Cross-Site Request Forgery"}],"references":[{"url":"https://hackerone.com/reports/189878","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0","tags":["x_refsource_MISC"]},{"url":"https://www.debian.org/security/2020/dsa-4766","tags":["vendor-advisory","x_refsource_DEBIAN"]}],"priority":{"score":14.8,"factors":[{"name":"EPSS percentile","points":14.78}]},"affectedVersions":[{"vendor":"n/a","product":"http://github.com/rails/rails","versions":["Fixed in 5.2.4.3, 6.0.3.1"]}],"affected":[{"ecosystem":"RubyGems","package":"actionview","vulnerableRanges":[">=5.0.0, <5.2.4.3",">=6.0.0, <6.0.3.1"],"patched":["5.2.4.3","6.0.3.1"],"from":["GHSA-xq5j-gw7f-jgj8"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0579","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2019-5418","published":"2019-03-27","fixed":"5.2.2.1","kev":true},{"cve":"CVE-2019-5419","published":"2019-03-27","fixed":"6.0.0.beta3","kev":false},{"cve":"CVE-2020-5267","published":"2020-03-19","fixed":"6.0.2.2","kev":false,"link":{"from":"CVE-2020-5267","to":"CVE-2020-8167","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.4.2","toFixed":"5.2.4.3","daysApart":92},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"6.0.2.2","toFixed":"6.0.3.1","daysApart":92}]}},{"cve":"CVE-2020-8167","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-15169","published":"2020-09-11","fixed":"6.0.3.3","kev":false,"link":{"from":"CVE-2020-8167","to":"CVE-2020-15169","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"5.2.4.3","toFixed":"5.2.4.4","daysApart":84},{"kind":"version-step","provenance":"source","package":"RubyGems:actionview","fromFixed":"6.0.3.1","toFixed":"6.0.3.3","daysApart":84}]}},{"cve":"CVE-2022-27777","published":"2022-05-26","fixed":"7.0.2.4","kev":false},{"cve":"CVE-2023-23913","published":"2025-01-09","fixed":"7.0.4.3","kev":false}],"package":"RubyGems:actionview"}}