CVE-2020-8162
rubygem-activestorage: circumvention of file size limits in ActiveStorage
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.
Se presenta una aplicación del lado del cliente de una vulnerabilidad de seguridad del lado del servidor en rails versiones anteriores a 5.2.4.2 y rails versiones anteriores a 6.0.3.1 El adaptador S3 de ActiveStorage que permite a un usuario final modificar el Content-Length de una carga directa de archivos sin pasar por los límites de carga
A flaw was found in rubygem-activestorage. The ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user. The highest threat from this vulnerability is to data integrity.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-28 CVE Reserved
- 2020-06-19 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2024-10-13 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-20: Improper Input Validation
- CWE-434: Unrestricted Upload of File with Dangerous Type
- CWE-602: Client-Side Enforcement of Server-Side Security
CAPEC
References (5)
URL | Tag | Source |
---|
URL | Date | SRC |
---|---|---|
https://hackerone.com/reports/789579 | 2024-08-04 |
URL | Date | SRC |
---|---|---|
https://groups.google.com/g/rubyonrails-security/c/PjU3946mreQ | 2022-05-24 |
URL | Date | SRC |
---|---|---|
https://www.debian.org/security/2020/dsa-4766 | 2022-05-24 | |
https://access.redhat.com/security/cve/CVE-2020-8162 | 2021-04-21 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1843005 | 2021-04-21 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | < 5.2.4.2 Search vendor "Rubyonrails" for product "Rails" and version " < 5.2.4.2" | - |
Affected
| ||||||
Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.0.0 < 6.0.3.1 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.0.0 < 6.0.3.1" | - |
Affected
| ||||||
Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
|