CVE-2020-8167

A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs module that could allow attackers to send CSRF tokens to wrong domains.

Score

CVSS 3.1 6.5 Medium

Status

Modified - support@hackerone.com

Published

2020-06-19

Last modified

2024-08-04

Weaknesses

CWE-352

Affected products

• Debian Linux (Debian)
• Rails (Rubyonrails)

References

• https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0
• https://hackerone.com/reports/189878
• https://www.debian.org/security/2020/dsa-4766