CVE-2020-8166

Name of the Vulnerable Software and Affected Versions rails versions prior to 5.2.5 rails versions prior to 6.0.4

Description A CSRF forgery issue exists that allows an attacker to forge a per-form CSRF token given a global CSRF token, such as the one present in the authenticity token meta tag. This enables the attacker to construct a per-form CSRF token for any action in that session.

Recommendations For rails versions prior to 5.2.5, update to version 5.2.5 or later. For rails versions prior to 6.0.4, update to version 6.0.4 or later.