CVE-2020-8166: Debian Linux

Medium severity, CVSS 4.3. EPSS: 1.7% chance of exploitation in the next 30 days.

A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.

Affected products

• Debian Debian Linux: version 10.0 only
• Rubyonrails Rails: before 5.2.4.3 (fixed in 5.2.4.3); from 6.0.0, before 6.0.3.1 (fixed in 6.0.3.1)

Published 2020-07-02. Last modified 2026-06-17.