{"schema_version":"1.7.5","id":"GHSA-jp5v-5gx4-jmj9","published":"2020-05-26T15:11:13Z","modified":"2026-05-05T22:34:32.923444Z","aliases":["CVE-2020-8166"],"summary":"Ability to forge per-form CSRF tokens in Rails","details":"It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.\n\nImpact\n------\n\nGiven the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.\n\nWorkarounds\n-----------\n\nThis is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.","affected":[{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.2.4.3"}]}],"versions":["5.0.0","5.0.0.1","5.0.1","5.0.1.rc1","5.0.1.rc2","5.0.2","5.0.2.rc1","5.0.3","5.0.4","5.0.4.rc1","5.0.5","5.0.5.rc1","5.0.5.rc2","5.0.6","5.0.6.rc1","5.0.7","5.0.7.1","5.0.7.2","5.1.0","5.1.0.beta1","5.1.0.rc1","5.1.0.rc2","5.1.1","5.1.2","5.1.2.rc1","5.1.3","5.1.3.rc1","5.1.3.rc2","5.1.3.rc3","5.1.4","5.1.4.rc1","5.1.5","5.1.5.rc1","5.1.6","5.1.6.1","5.1.6.2","5.1.7","5.1.7.rc1","5.2.0","5.2.0.beta1","5.2.0.beta2","5.2.0.rc1","5.2.0.rc2","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.rc1"],"database_specific":{"last_known_affected_version_range":"<= 5.2.4.2","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-jp5v-5gx4-jmj9/GHSA-jp5v-5gx4-jmj9.json"}},{"package":{"name":"actionpack","ecosystem":"RubyGems","purl":"pkg:gem/actionpack"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.3.1"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.rc1"],"database_specific":{"last_known_affected_version_range":"<= 6.0.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/05/GHSA-jp5v-5gx4-jmj9/GHSA-jp5v-5gx4-jmj9.json"}}],"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8166"},{"type":"WEB","url":"https://hackerone.com/reports/732415"},{"type":"PACKAGE","url":"https://github.com/rails/rails"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8166.yml"},{"type":"WEB","url":"https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw"},{"type":"WEB","url":"https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4766"}],"database_specific":{"cwe_ids":["CWE-352"],"github_reviewed":true,"github_reviewed_at":"2020-05-26T15:10:56Z","nvd_published_at":"2020-07-02T19:15:12Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N"}]}