PT-2020-20009 · Ruby On Rails+3 · Rails+3
Published
2020-06-24
·
Updated
2025-09-29
·
CVE-2020-8185
CVSS v2.0
6.8
Medium
| Vector | AV:N/AC:L/Au:S/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
Rails versions prior to 6.0.3.2
Description
A denial of service issue exists that allows an untrusted user to run any pending migrations on a Rails app running in production. This issue enables an attacker to execute migrations that are pending for a Rails app in production mode, although they are limited to running migrations already defined by the application developer and ones that have not already run.
Recommendations
For versions prior to 6.0.3.2, update to Rails version 6.0.3.2 or later to resolve the issue.
As a temporary workaround, consider disabling the ActionDispatch middleware in the production environment by adding the line
config.middleware.delete ActionDispatch::ActionableExceptions to the config/environment/production.rb file.Exploit
Fix
DoS
Improper Authorization
Resource Exhaustion
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Rails
Red Os
Suse