Test ID:	1.3.6.1.4.1.25623.1.0.113713
Category:	Web application abuses
Title:	Ruby on Rails < 5.2.5, 6.x < 6.0.4 CSRF Vulnerability
Summary:	Ruby on Rails is prone to a cross-site request forgery (CSRF) vulnerability.
Description:	Summary: Ruby on Rails is prone to a cross-site request forgery (CSRF) vulnerability. Vulnerability Insight: An attacker can use a global CSRF token, as can be found in the authenticity_token meta tag, to forge form-specific CSRF tokens. Vulnerability Impact: Successful exploitation would allow an authenticated attacer to perform actions in the context of another user. Affected Software/OS: Ruby on Rails through version 5.2.4 and versions 6.0.0 through 6.0.3. Solution: Update to version 5.2.5 or 6.0.4 respectively. CVSS Score: 4.3 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-8166 Debian Security Information: DSA-4766 (Google Search) https://www.debian.org/security/2020/dsa-4766 https://groups.google.com/g/rubyonrails-security/c/NOjKiGeXUgw https://hackerone.com/reports/732415
Copyright	Copyright (C) 2020 Greenbone Networks GmbH

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.