onyx --cves cve-2020-8165
CVE-2020-8165
- score
- <0.1
- cvss
- 9.8
- epss
- 45.7%
- published
- 2020-06-19
- kev added
- —
- first seen
Rails < 5.2.4.3, Rails < 6.0.3.1 contain a deserialization of untrusted data caused by unmarshalling user-provided objects in MemCacheStore and RedisCacheStore, letting attackers execute arbitrary code, exploit requires attacker to control cache data.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Tracked by Onyx
- Public PoC
Exploit availability
Public PoC flagged by vulnx; no direct exploit link among the citations.
Weaknesses
References 9
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.html
- https://hackerone.com/reports/413388
- https://security.netapp.com/advisory/ntap-20250509-0002/
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.html
- https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1c
- https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- https://www.debian.org/security/2020/dsa-4766
- https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/