{"id":"CVE-2020-8185","published":"2020-07-02T18:35:06Z","modified":"2024-08-04T09:56:28Z","title":"A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending…","vendor":null,"product":null,"tier":"tail","description":{"text":"A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02181,"percentile":0.82296,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://hackerone.com/reports/899069","tags":["x_refsource_MISC"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/","tags":["vendor-advisory","x_refsource_FEDORA"]}],"priority":{"score":16.5,"factors":[{"name":"EPSS percentile","points":16.46}]},"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["Fixed in 6.0.3.2"]}],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.2"],"patched":["6.0.3.2"],"from":["GHSA-c6qr-h5vq-59jc"],"provenance":"source"}],"euvd":{"id":"EUVD-2020-0479","exploited":false,"provenance":"source"},"lineage":{"packageHistory":[{"cve":"CVE-2016-2098","published":"2016-04-07","fixed":"4.2.5.2","kev":false},{"cve":"CVE-2020-8164","published":"2020-06-19","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false,"link":{"from":"CVE-2020-8166","to":"CVE-2020-8185","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.1","toFixed":"6.0.3.2","daysApart":0}]}},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false},{"cve":"CVE-2020-8264","published":"2021-01-06","fixed":"6.0.3.4","kev":false,"link":{"from":"CVE-2020-8185","to":"CVE-2020-8264","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.2","toFixed":"6.0.3.4","daysApart":188}]}},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false}],"package":"RubyGems:actionpack"}}