A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade rails | Jun 22, 2020 | Jun 19, 2020 |
| Freebsd | — | Upgrade rubygem-actionpack60Upgrade rubygem-activestorage52Upgrade rubygem-actionview52Upgrade rubygem-activesupport60Upgrade rubygem-actionview60Upgrade rubygem-activestorage60Upgrade rubygem-activesupport52Upgrade rubygem-actionpack52 | May 20, 2020 | May 19, 2020 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jun 29, 2020 | Jun 19, 2020 |
| Suse | — | Upgrade rmt-server-configUpgrade ruby2.5-rubygem-actionpack-5_1Upgrade rmt-server-pubcloudUpgrade rmt-serverUpgrade ruby2.5-rubygem-actionpack-doc-5_1 | Sep 26, 2020 | May 18, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub