{"id":"CVE-2020-8167","aliases":["GHSA-xq5j-gw7f-jgj8"],"url":"https://o3.security/vulnerability/CVE-2020-8167","summary":"CSRF Vulnerability in rails-ujs","details":"There is a vulnerability in rails-ujs that allows attackers to send CSRF tokens to wrong domains.\n\nVersions Affected:  rails <= 6.0.3\nNot affected:       Applications which don't use rails-ujs.\nFixed Versions:     rails >= 5.2.4.3, rails >= 6.0.3.1\n\nImpact\n------\n\nThis is a regression of CVE-2015-1840.\n\nIn the scenario where an attacker might be able to control the href attribute of an anchor tag or the action attribute of a form tag that will trigger a POST action, the attacker can set the href or action to a cross-origin URL, and the CSRF token will be sent.\n\nWorkarounds\n-----------\n\nTo work around this problem, change code that allows users to control the href attribute of an anchor tag or the action attribute of a form tag to filter the user parameters.\n\nFor example, code like this:\n\n    link_to params\n\nto code like this:\n\n    link_to filtered_params\n\n    def filtered_params\n      # Filter just the parameters that you trust\n    end","published":"2020-06-19T18:15:11.163Z","modified":"2026-10-24T10:30:35.122068993Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"5.2.4.3"},{"ecosystem":"RubyGems","name":"actionview","fixedVersion":"6.0.3.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://www.debian.org/security/2020/dsa-4766"},{"type":"FIX","url":"https://groups.google.com/g/rubyonrails-security/c/x9DixQDG9a0"},{"type":"EVIDENCE","url":"https://hackerone.com/reports/189878"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8167"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-8167.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:35.122068993Z"}}