7.5
CVSSv2

CVE-2020-8165

Published: 19/06/2020 Updated: 24/05/2022
CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 670
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an malicious user to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

rubyonrails rails

debian debian linux 8.0

debian debian linux 9.0

debian debian linux 10.0

opensuse leap 15.1

opensuse leap 15.2

Vendor Advisories

Multiple security issues were discovered in the Rails web framework which could result in cross-site scripting, information leaks, code execution, cross-site request forgery or bypass of upload limits For the stable distribution (buster), these problems have been fixed in version 2:5221+dfsg-1+deb10u2 We recommend that you upgrade your rails p ...

Github Repositories

CVE-2020-8165 Python Exploit This is code to exploit CVE-2020-8165 using Python3 This exploit works with rails &lt; 5243, rails &lt; 6031 The exploit allows an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore This exploit code uses ArgParse to allow the user to very simply exploit this vulnerability Usage There are five argument

CVE-2020-8165 I really don't know who wrote it, however: amazing script that avoid you to use Burp and Curl stuff

CVE-2020-8165 Demo Yet another demo of CVE-2020-8165, though in a more realistic implementation than most Background CVE-2020-8165 A deserialization of untrusted data vulnernerability exists in rails &lt; 5243, rails &lt; 6031 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE Refe

CVE-2020-8165py A shell for CVE-2020-8165 exploit: githubcom/masahiro331/CVE-2020-8165 Usage: CVE-2020-8165py IP IP:PORT CVE-2020-8165py 2323 10101010:4444

CVE-2020-8165 Python Exploit This is code to exploit CVE-2020-8165 using Python3 This exploit works with rails &lt; 5243, rails &lt; 6031 The exploit allows an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore This exploit code uses ArgParse to allow the user to very simply exploit this vulnerability Usage There are five argument

CVE-2020-8165 (Ruby on Rails) For educational purposes only See Reference for the details Environment

CVE-2020-8165 (Ruby on Rails) For educational purposes only See Reference for the details Environment