Description

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorage's S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.

Remediation

References

CVE-2020-8162

Related Vulnerabilities

WordPress Plugin PHP Everywhere Multiple Remote Code Execution Vulnerabilities (2.0.3)

Apache Tomcat Insufficient Verification of Data Authenticity Vulnerability (CVE-2017-7674)

WordPress Plugin Centrora Security Multiple Vulnerabilities (6.5.6)

Collabtive Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-48708)

Oracle HTTP Server Improper Privilege Management Vulnerability (CVE-2026-60454)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-434 CVE-2020-8162