CVE-2020-8264

NameCVE-2020-8264
DescriptionIn actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs971988

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)buster2:5.2.2.1+dfsg-1+deb10u3fixed
buster (security)2:5.2.2.1+dfsg-1+deb10u5fixed
bullseye2:6.0.3.7+dfsg-2fixed
bookworm, sid2:6.1.7+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssourcestretch(not affected)
railssourcebuster(not affected)
railssource(unstable)2:6.0.3.4+dfsg-1971988

Notes

[buster] - rails <not-affected> (Vulnerable code not present)
[stretch] - rails <not-affected> (Vulnerable code not present)
https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ

Search for package or bug name: Reporting problems