There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write unescaped ERB to a view.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write     arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write     unescaped ERB to a view. (CVE-2020-8159)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write
    arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write
    unescaped ERB to a view. (CVE-2020-8159)

The remote Debian 9 host has a package installed that is affected by a vulnerability as referenced in the dla-2719 advisory.

  - There is a vulnerability in actionpack_page-caching gem < v1.2.1 that allows an attacker to write     arbitrary files to a web server, potentially resulting in remote code execution if the attacker can write     unescaped ERB to a view. (CVE-2020-8159)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
256396	Linux Distros Unpatched Vulnerability : CVE-2020-8159	Nessus	Misc.	critical
423145	SCA: security update for actionpack-page_caching (GHSA-mg5p-95m9-rmfp)	Tenable Cloud Security	SCA Checks	critical
423145	SCA: security update for actionpack-page_caching (GHSA-mg5p-95m9-rmfp)	Tenable Self-Hosted Container Security	SCA Checks	critical
152059	Debian DLA-2719-1 : ruby-actionpack-page-caching - LTS security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-8159

critical

Tenable Plugins

critical

critical

critical

critical