The vulnerability of the each_pair function in the strong_parameters.rb software platform for Ruby on Rails allows a hacker to gain access to confidential data.

🗓️ 15 Mar 2021 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The each_pair vulnerability in strong_parameters.rb on Ruby on Rails can expose confidential data via faulty memory restoration.

Reporter	Title	Published	Views	Family All 176
FreeBSD	Rails -- multiple vulnerabilities	18 May 202000:00	–	freebsd
FreeBSD	Rails -- permission vulnerability	17 Jun 202000:00	–	freebsd
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Rails	18 Jul 202006:08	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8164).	1 Oct 202013:27	–	ibm
IBM Security Bulletins	Security Bulletin: A vulnerability in Ruby on Rails affects IBM License Metric Tool v9 (CVE-2020-8166).	1 Oct 202013:31	–	ibm
BDU FSTEC	The vulnerability of the Ruby on Rails software platform, related to improper authentication, allows a hacker to trigger a service failure.	17 Jul 202500:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the Ruby on Rails software platform, related to the， CSRF token。	17 Jul 202500:00	–	bdu_fstec
CNVD	Ruby on Rails Cross-Site Request Forgery Vulnerability (CNVD-2020-32423)	21 May 202000:00	–	cnvd
CNVD	Ruby on Rails Code Issue Vulnerability (CNVD-2020-40605)	21 May 202000:00	–	cnvd
CNVD	Rails Denial of Service Vulnerability	3 Jul 202000:00	–	cnvd

Vulners

Node

rails_core ruby_on_railsRange<5.2.4.3

OR

rails_core ruby_on_railsRange6.0.0–6.0.3.1

Source	Link
groups	www.groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY
hackerone	www.hackerone.com/reports/292797
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-8164
security-tracker	www.security-tracker.debian.org/tracker/CVE-2020-8164
wiki	www.wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16
wiki	www.wiki.astralinux.ru/astra-linux-se81-bulletin-20211019SE81
strelets	www.strelets.net/patchi-i-obnovleniya-bezopasnosti
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-rubygem-actionpack-cve-2020-8164-cve-2020-8185-cve-2020-8166/
web	www.web.nvd.nist.gov/view/vuln/detail

01 Jul 2025 00:00Current

6.5Medium risk

Vulners AI Score6.5

CVSS 25

CVSS 37.5

EPSS0.04198

ruby on rails strong parameters each_pair vulnerability memory restoration confidential data