Arbitrary File Write Vulnerability in Actionpack Page-Caching Gem from Ruby
CVE-2020-8159
9.8CRITICAL
What is CVE-2020-8159?
A vulnerability exists in the Actionpack Page-Caching gem prior to version 1.2.1 that enables attackers to write arbitrary files on the web server. This can lead to serious security issues, including the potential for remote code execution if an attacker manages to write unescaped ERB content to a view. It highlights the importance of keeping software dependencies updated and maintaining robust security practices.
Affected Version(s)
https://github.com/rails/actionpack-page_caching v1.2.1
References
EPSS Score
5% chance of being exploited in the next 30 days.
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved