CVE-2020-8162

rubygem-activestorage: circumvention of file size limits in ActiveStorage

Published Jun 19, 2020 CVSS 3.1 · 7.5 High EPSS 3.0% KEV · Not listed
Description
A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DSA Debian DSA DSA-4766-1 rails security update
EUVD EUVD EUVD-2020-0430 A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.
Github GHSA Github GHSA GHSA-m42x-37p3-fv5w Circumvention of file size limits in ActiveStorage
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
hackerone
Published
Updated
Aug 4, 2024, 9:48 AM
Reserved
Jan 28, 2020, 12:00 AM
Status
Modified
Published
Jun 19, 2020, 5:15 PM
Modified
Jun 17, 2026, 3:25 AM
Severity
Important
Public date
May 18, 2020, 12:00 AM