CVE-2020-8185

Name of the Vulnerable Software and Affected Versions Rails versions prior to 6.0.3.2

Description A denial of service issue exists that allows an untrusted user to run any pending migrations on a Rails app running in production. This issue enables an attacker to execute migrations that are pending for a Rails app in production mode, although they are limited to running migrations already defined by the application developer and ones that have not already run.

Recommendations For versions prior to 6.0.3.2, update to Rails version 6.0.3.2 or later to resolve the issue. As a temporary workaround, consider disabling the ActionDispatch middleware in the production environment by adding the line config.middleware.delete ActionDispatch::ActionableExceptions to the config/environment/production.rb file.