CVE-2020-8166
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
- Score
- CVSS 3.1 4.3 Medium
- Status
- Modified - support@hackerone.com
- Published
- 2020-07-02
- Last modified
- 2026-04-28
- Weaknesses
- CWE-352
Affected products
References
- https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw
- https://hackerone.com/reports/732415
- https://www.debian.org/security/2020/dsa-4766
