CVE-2020-8185
MEDIUMRails 6.0.0-6.0.3.1 - Unauthenticated Denial of Service via Pending Migration Execution
Title source: llmDescription
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
References (3)
Core 3
Core References
Permissions Required, Third Party Advisory x_refsource_misc
https://hackerone.com/reports/899069
Mailing List, Patch, Third Party Advisory x_refsource_misc
https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
Mailing List, Third Party Advisory vendor-advisory
x_refsource_fedora
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
Scores
CVSS v3
6.5
EPSS
0.0068
EPSS Percentile
71.8%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-400
Status
published
Products (3)
fedoraproject/fedora
33
rubygems/actionpack
6.0.0 - 6.0.3.2RubyGems
rubyonrails/rails
6.0.0 - 6.0.3.2
Published
Jul 02, 2020
Tracked Since
Feb 18, 2026