{"action":"Upgrade actionpack to 6.0.3.2 or later.","affected":[{"fixed":"6.0.3.2","introduced":"6.0.0"}],"component":"actionpack","cve_ids":["CVE-2020-8185"],"ecosystem":"RubyGems","epss":0.02181,"exploited":false,"fixed_versions":["6.0.3.2"],"ghsa_id":"GHSA-c6qr-h5vq-59jc","id":"tcs_01M5KEJN699YK5WHSNN5FY312S","modified_at":"2024-02-22T05:37:18.964730Z","published_at":"2020-06-24T17:40:33Z","references":["https://osv.dev/vulnerability/GHSA-c6qr-h5vq-59jc","https://nvd.nist.gov/vuln/detail/CVE-2020-8185","https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2","https://hackerone.com/reports/899069","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml","https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-c6qr-h5vq-59jc","url":"https://osv.dev/vulnerability/GHSA-c6qr-h5vq-59jc"}],"summary":"Untrusted users can run pending migrations in production in Rails"}