CVE-2020-8264: XSS
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2020-8264?
The severity of CVE-2020-8264 is medium with a CVSS score of 6.1.
How does CVE-2020-8264 impact the actionpack gem?
CVE-2020-8264 affects the actionpack gem versions 6.0.0 to 6.0.3.3, allowing a possible XSS vulnerability in development mode.
How can an attacker exploit CVE-2020-8264?
An attacker can exploit CVE-2020-8264 by sending or embedding a specially crafted URL in another page, allowing them to execute JavaScript in the context of the local application.
What is the recommended remedy for CVE-2020-8264?
To remediate CVE-2020-8264, it is recommended to upgrade the actionpack gem to version 6.0.3.4 or higher.
Is Rubyonrails Rails affected by CVE-2020-8264?
Yes, Rubyonrails Rails versions 6.0.0 to 6.0.3.3 are also affected by CVE-2020-8264.