CVE-2020-8163: Code Injection
The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the locals argument of a render call to perform a RCE.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8163?
The severity of CVE-2020-8163 is high with a severity value of 8.8.
What is the affected software for CVE-2020-8163?
The affected software for CVE-2020-8163 includes versions of Ruby on Rails prior to 5.0.1 and Debian Linux 9.0.
How can an attacker exploit CVE-2020-8163?
An attacker can exploit CVE-2020-8163 by controlling the 'locals' argument of a 'render' call to perform a remote code execution.
Are there any references for CVE-2020-8163?
Yes, you can find references for CVE-2020-8163 at the following URLs: [http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html](http://packetstormsecurity.com/files/158604/Ruby-On-Rails-5.0.1-Remote-Code-Execution.html), [https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0](https://groups.google.com/g/rubyonrails-security/c/hWuKcHyoKh0), [https://hackerone.com/reports/304805](https://hackerone.com/reports/304805).
Is there a Common Weakness Enumeration (CWE) associated with CVE-2020-8163?
Yes, the Common Weakness Enumeration (CWE) associated with CVE-2020-8163 is CWE-94.