CVE-2020-8165

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

• CWE-502
• CWE-502

• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.htmlMailing List, Third Party Advisory
• https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1cMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/413388Exploit, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlMailing List, Third Party Advisory
• https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/Vendor Advisory
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00031.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00034.htmlMailing List, Third Party Advisory
• https://groups.google.com/g/rubyonrails-security/c/bv6fW4S0Y1cMailing List, Patch, Third Party Advisory
• https://hackerone.com/reports/413388Exploit, Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/06/msg00022.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/07/msg00013.htmlMailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20250509-0002/
• https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/Vendor Advisory
• https://www.debian.org/security/2020/dsa-4766Third Party Advisory

Published

Jun 19, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8159There is a vulnerability in actionpack_page-caching gem < v1…9.8
• CVE-2020-8160MendixSSO <= 2.1.1 contains endpoints that make use of the o…6.1
• CVE-2020-8161A directory traversal vulnerability exists in rack < 2.2.0 t…8.6
• CVE-2020-8162A client side enforcement of server side security vulnerabil…7.5
• CVE-2020-8163The is a code injection vulnerability in versions of Rails p…8.8
• CVE-2020-8164A deserialization of untrusted data vulnerability exists in …7.5
• CVE-2020-8166A CSRF forgery vulnerability exists in rails < 5.2.5, rails …4.3
• CVE-2020-8167A CSRF vulnerability exists in rails <= 6.0.3 rails-ujs modu…6.5
• CVE-2020-8168We have recently released new version of AirMax AirOS firmwa…8.8
• CVE-2020-8169curl 7.62.0 through 7.70.0 is vulnerable to an information d…7.5
• CVE-2020-8170We have recently released new version of AirMax AirOS firmwa…6.1
• CVE-2020-8171We have recently released new version of AirMax AirOS firmwa…9.8