Description

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Remediation

References

CVE-2020-8165

Related Vulnerabilities

WordPress 4.5.3 Directory Traversal Vulnerability (4.5.3)

Coppermine Multiple Cross-site Scripting (XSS) Vulnerabilities (CVE-2015-6528)

WordPress Plugin BuddyBoss Media Cross-Site Scripting (3.0.3)

WordPress Plugin Awesome Support-WordPress HelpDesk & Support Cross-Site Scripting (6.0.5)

WordPress Plugin Custom Map Cross-Site Scripting (1.1)

Severity

Critical

Classification

CVE-2020-8165 CWE-502 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities