CVE-2020-8163CWE-94

CVE-2020-8163: vulnerability in https://github.com/rails/rails

Published · Updated

Follow this CVE+ Monitor https://github.com/rails/rails+ Monitor rails

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

62Vexday Risk Score

Patch soon. It has a working public exploit.

ssvc Attendepss 82%
from disclosure to weaponsame day
Published on NVDJul 2
1st PoCJun 19
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
2 products (6 components) — because the vulnerable code is not present in the product
CloudForms Management Engine 5 · Red Hat Satellite 6
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.
Affected products
n/a · https://github.com/rails/rails
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.