Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2020-8185: Unsecured Database Access in Rails Versions Before 6.0.3.2
CVE-2020-8185 · published 6 years ago
Summary
A known security issue in older versions of Rails allows unauthorized users to run database changes on your application, potentially disrupting its operation. This issue affects Rails apps that haven't updated to version 6.0.3.2 or later. Update your Rails version to the latest patch release to prevent unauthorized access.
What to do
- Update david heinemeier hansson actionpack to version 6.0.3.2.
- Update rubyonrails rails to version 6.0.3.2 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| rubygems | david heinemeier hansson | actionpack |
>= 6.0.0, <= 6.0.3.1 Fix: upgrade to 6.0.3.2
|
| – | rubyonrails | rails |
>= 6.0.0, < 6.0.3.2 cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
33 cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Ubuntu:Pro:16.04:LTS | canonical | rails | All versions |
Original advisory text
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
A denial of service vulnerability exists in Rails <6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-8185
- https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020...
- https://lists.fedoraproject.org/archives/list/[email protected]...
- https://github.com/advisories/GHSA-c6qr-h5vq-59jc
- https://hackerone.com/reports/899069 Third Party Advisory
- https://ubuntu.com/security/CVE-2020-8185 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-8185 Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... URL
- https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0 Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published2 Jul 2020
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-c6qr-h5vq-59jc · GHSA
CVE-2020-8185 · NVD
UBUNTU-CVE-2020-8185 · OSV
CVE-2020-8185 · OSV
Track software like this
Free during beta