CVE-2020-8166 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2020-8166 Interim 1 60 2023-09-26T23:50:22Z current 2021-05-30T14:37:49Z 2023-09-26T23:50:22Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2020-8166 A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2020-October/007625.html E-Mail link for SUSE-SU-2020:3036-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007691.html E-Mail link for SUSE-SU-2020:3147-1 https://lists.suse.com/pipermail/sle-security-updates/2020-November/007702.html E-Mail link for SUSE-SU-2020:3160-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2W26GJJ7QXIADWB6ZCQWC2BUZD2ALYVT/ E-Mail link for openSUSE-SU-2020:1993-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7MCDUWQEXA3XGI7X2XPATA7YTNVDYTSF/ E-Mail link for openSUSE-SU-2020:2000-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise High Availability Extension 15 SP1 SUSE Linux Enterprise High Availability Extension 15 SP2 SUSE Linux Enterprise High Availability Extension 15 SP3 SUSE Linux Enterprise High Availability Extension 15 SP4 SUSE Linux Enterprise High Availability Extension 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server Business Critical Linux 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP5 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Retail Branch Server 4.2 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Public Cloud 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP1 SUSE Linux Enterprise Module for Public Cloud 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Public Cloud 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Manager Server 4.2 SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE OpenStack Cloud 6-LTSS SUSE OpenStack Cloud 7 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Leap 15.1 openSUSE Leap 15.2 openSUSE Tumbleweed rmt-server rmt-server-2.6.13-1.1 rmt-server-2.6.5-3.18.1 rmt-server-2.6.5-3.3.1 rmt-server-2.6.5-3.34.1 rmt-server-2.6.5-lp151.2.18.2 rmt-server-2.6.5-lp152.2.3.1 rmt-server-2.6.8-1.2 rmt-server-2.7.1-150400.1.7 rmt-server-config rmt-server-config-2.6.13-1.1 rmt-server-config-2.6.5-3.18.1 rmt-server-config-2.6.5-3.3.1 rmt-server-config-2.6.5-3.34.1 rmt-server-config-2.6.5-lp151.2.18.2 rmt-server-config-2.6.5-lp152.2.3.1 rmt-server-config-2.6.8-1.2 rmt-server-config-2.7.1-150400.1.7 rmt-server-pubcloud rmt-server-pubcloud-2.6.13-1.1 rmt-server-pubcloud-2.6.5-3.18.1 rmt-server-pubcloud-2.6.5-3.3.1 rmt-server-pubcloud-2.6.5-lp151.2.18.2 rmt-server-pubcloud-2.6.5-lp152.2.3.1 rmt-server-pubcloud-2.6.8-1.2 rmt-server-pubcloud-2.7.1-150400.1.7 rmt-server-pubcloud-2.9-150500.1.4 ruby2.1-rubygem-rails-4_2 ruby2.5-rubygem-rails-5_1 ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 ruby3.0-rubygem-actionpack-5.2-5.2.6-1.2 ruby3.0-rubygem-actionpack-6.0-6.0.4-1.2 ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 rubygem-rails-4_2 rubygem-rails-5_1 rmt-server-2.6.5-3.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server-config-2.6.5-3.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS rmt-server-2.6.5-3.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server-config-2.6.5-3.34.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS rmt-server-pubcloud-2.6.5-3.18.1 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP1 rmt-server-pubcloud-2.6.5-3.3.1 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP2 rmt-server-pubcloud-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 rmt-server-pubcloud-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP4 rmt-server-pubcloud-2.9-150500.1.4 as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP5 rmt-server-2.6.5-3.18.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 rmt-server-config-2.6.5-3.18.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 rmt-server-2.6.5-3.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 rmt-server-config-2.6.5-3.3.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 rmt-server-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server-config-2.6.8-1.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rmt-server-config-2.7.1-150400.1.7 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 rmt-server-2.6.5-3.34.1 as a component of SUSE Linux Enterprise Server 15-LTSS rmt-server-config-2.6.5-3.34.1 as a component of SUSE Linux Enterprise Server 15-LTSS rmt-server-2.6.5-3.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 rmt-server-config-2.6.5-3.34.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 rmt-server-2.6.5-lp151.2.18.2 as a component of openSUSE Leap 15.1 rmt-server-config-2.6.5-lp151.2.18.2 as a component of openSUSE Leap 15.1 rmt-server-pubcloud-2.6.5-lp151.2.18.2 as a component of openSUSE Leap 15.1 rmt-server-2.6.5-lp152.2.3.1 as a component of openSUSE Leap 15.2 rmt-server-config-2.6.5-lp152.2.3.1 as a component of openSUSE Leap 15.2 rmt-server-pubcloud-2.6.5-lp152.2.3.1 as a component of openSUSE Leap 15.2 rmt-server-2.6.13-1.1 as a component of openSUSE Tumbleweed rmt-server-config-2.6.13-1.1 as a component of openSUSE Tumbleweed rmt-server-pubcloud-2.6.13-1.1 as a component of openSUSE Tumbleweed ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 as a component of openSUSE Tumbleweed ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 as a component of openSUSE Tumbleweed ruby3.0-rubygem-actionpack-5.2-5.2.6-1.2 as a component of openSUSE Tumbleweed ruby3.0-rubygem-actionpack-6.0-6.0.4-1.2 as a component of openSUSE Tumbleweed ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 as a component of openSUSE Tumbleweed rmt-server as a component of SUSE Enterprise Storage 7.1 rmt-server-config as a component of SUSE Enterprise Storage 7.1 ruby2.5-rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP1 rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP1 ruby2.5-rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP2 ruby2.5-rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP3 rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP3 ruby2.5-rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP4 rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP4 ruby2.5-rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP5 rubygem-rails-5_1 as a component of SUSE Linux Enterprise High Availability Extension 15 SP5 rmt-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS rmt-server-config as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS rmt-server as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rmt-server-config as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS rmt-server-pubcloud as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 rmt-server as a component of SUSE Linux Enterprise Module for Public Cloud 15 SP3 rmt-server as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server-config as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 rmt-server as a component of SUSE Linux Enterprise Real Time 15 SP3 rmt-server-config as a component of SUSE Linux Enterprise Real Time 15 SP3 rmt-server as a component of SUSE Linux Enterprise Server Business Critical Linux 15 SP3 rmt-server as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rmt-server-config as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 rmt-server as a component of SUSE Manager Proxy 4.2 rmt-server-config as a component of SUSE Manager Proxy 4.2 rmt-server as a component of SUSE Manager Retail Branch Server 4.2 rmt-server-config as a component of SUSE Manager Retail Branch Server 4.2 rmt-server as a component of SUSE Manager Server 4.2 rmt-server-config as a component of SUSE Manager Server 4.2 ruby2.1-rubygem-rails-4_2 as a component of SUSE OpenStack Cloud 6-LTSS rubygem-rails-4_2 as a component of SUSE OpenStack Cloud 6-LTSS ruby2.1-rubygem-rails-4_2 as a component of SUSE OpenStack Cloud 7 rubygem-rails-4_2 as a component of SUSE OpenStack Cloud 7 ruby2.1-rubygem-rails-4_2 as a component of SUSE OpenStack Cloud Crowbar 8 rubygem-rails-4_2 as a component of SUSE OpenStack Cloud Crowbar 8 ruby2.1-rubygem-rails-4_2 as a component of SUSE OpenStack Cloud Crowbar 9 rubygem-rails-4_2 as a component of SUSE OpenStack Cloud Crowbar 9 A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token. CVE-2020-8166 SUSE Linux Enterprise High Performance Computing 15-ESPOS:rmt-server-2.6.5-3.34.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:rmt-server-config-2.6.5-3.34.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:rmt-server-2.6.5-3.34.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:rmt-server-config-2.6.5-3.34.1 SUSE Linux Enterprise Module for Public Cloud 15 SP1:rmt-server-pubcloud-2.6.5-3.18.1 SUSE Linux Enterprise Module for Public Cloud 15 SP2:rmt-server-pubcloud-2.6.5-3.3.1 SUSE Linux Enterprise Module for Public Cloud 15 SP3:rmt-server-pubcloud-2.6.8-1.2 SUSE Linux Enterprise Module for Public Cloud 15 SP4:rmt-server-pubcloud-2.7.1-150400.1.7 SUSE Linux Enterprise Module for Public Cloud 15 SP5:rmt-server-pubcloud-2.9-150500.1.4 SUSE Linux Enterprise Module for Server Applications 15 SP1:rmt-server-2.6.5-3.18.1 SUSE Linux Enterprise Module for Server Applications 15 SP1:rmt-server-config-2.6.5-3.18.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:rmt-server-2.6.5-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP2:rmt-server-config-2.6.5-3.3.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server-2.6.8-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server-config-2.6.8-1.2 SUSE Linux Enterprise Module for Server Applications 15 SP4:rmt-server-2.7.1-150400.1.7 SUSE Linux Enterprise Module for Server Applications 15 SP4:rmt-server-config-2.7.1-150400.1.7 SUSE Linux Enterprise Server 15-LTSS:rmt-server-2.6.5-3.34.1 SUSE Linux Enterprise Server 15-LTSS:rmt-server-config-2.6.5-3.34.1 SUSE Linux Enterprise Server for SAP Applications 15:rmt-server-2.6.5-3.34.1 SUSE Linux Enterprise Server for SAP Applications 15:rmt-server-config-2.6.5-3.34.1 openSUSE Leap 15.1:rmt-server-2.6.5-lp151.2.18.2 openSUSE Leap 15.1:rmt-server-config-2.6.5-lp151.2.18.2 openSUSE Leap 15.1:rmt-server-pubcloud-2.6.5-lp151.2.18.2 openSUSE Leap 15.2:rmt-server-2.6.5-lp152.2.3.1 openSUSE Leap 15.2:rmt-server-config-2.6.5-lp152.2.3.1 openSUSE Leap 15.2:rmt-server-pubcloud-2.6.5-lp152.2.3.1 openSUSE Tumbleweed:rmt-server-2.6.13-1.1 openSUSE Tumbleweed:rmt-server-config-2.6.13-1.1 openSUSE Tumbleweed:rmt-server-pubcloud-2.6.13-1.1 openSUSE Tumbleweed:ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 openSUSE Tumbleweed:ruby2.7-rubygem-actionpack-6.0-6.0.4-1.2 openSUSE Tumbleweed:ruby3.0-rubygem-actionpack-5.2-5.2.6-1.2 openSUSE Tumbleweed:ruby3.0-rubygem-actionpack-6.0-6.0.4-1.2 openSUSE Tumbleweed:ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 SUSE Enterprise Storage 7.1:rmt-server SUSE Enterprise Storage 7.1:rmt-server-config SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:rmt-server SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:rmt-server-config SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rmt-server SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:rmt-server-config SUSE Linux Enterprise Module for Public Cloud 15 SP3:rmt-server SUSE Linux Enterprise Module for Public Cloud 15 SP3:rmt-server-pubcloud SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server SUSE Linux Enterprise Module for Server Applications 15 SP3:rmt-server-config SUSE Linux Enterprise Real Time 15 SP3:rmt-server SUSE Linux Enterprise Real Time 15 SP3:rmt-server-config SUSE Linux Enterprise Server Business Critical Linux 15 SP3:rmt-server SUSE Linux Enterprise Server for SAP Applications 15 SP3:rmt-server SUSE Linux Enterprise Server for SAP Applications 15 SP3:rmt-server-config SUSE Manager Proxy 4.2:rmt-server SUSE Manager Proxy 4.2:rmt-server-config SUSE Manager Retail Branch Server 4.2:rmt-server SUSE Manager Retail Branch Server 4.2:rmt-server-config SUSE Manager Server 4.2:rmt-server SUSE Manager Server 4.2:rmt-server-config SUSE OpenStack Cloud 6-LTSS:ruby2.1-rubygem-rails-4_2 SUSE OpenStack Cloud 6-LTSS:rubygem-rails-4_2 SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2 SUSE OpenStack Cloud 7:rubygem-rails-4_2 SUSE OpenStack Cloud Crowbar 8:ruby2.1-rubygem-rails-4_2 SUSE OpenStack Cloud Crowbar 8:rubygem-rails-4_2 SUSE OpenStack Cloud Crowbar 9:ruby2.1-rubygem-rails-4_2 SUSE OpenStack Cloud Crowbar 9:rubygem-rails-4_2 SUSE Linux Enterprise High Availability Extension 15 SP1:ruby2.5-rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP1:rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP2:rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP3:rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP4:rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP5:ruby2.5-rubygem-rails-5_1 SUSE Linux Enterprise High Availability Extension 15 SP5:rubygem-rails-5_1 low 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N