{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-09-23T05:27:22.864","vulnerabilities":[{"cve":{"id":"CVE-2020-8264","sourceIdentifier":"support@hackerone.com","published":"2021-01-06T21:15:14.363","lastModified":"2026-06-17T03:26:09.527","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware."},{"lang":"es","value":"En actionpack gem versiones posteriores a 6.0.0 incluyéndola, se presenta una posible vulnerabilidad de tipo XSS cuando una aplicación se ejecuta en modo development permitiendo a un atacante enviar o insertar (en otra página) una URL especialmente diseñada que puede permitir al atacante ejecutar JavaScript en el contexto de la aplicación local. Esta vulnerabilidad se encuentra en el middleware de Excepciones Accionables"}],"affected":[{"source":"support@hackerone.com","affectedData":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":[{"version":"6.0.3.4","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"weaknesses":[{"source":"support@hackerone.com","type":"Secondary","description":[{"lang":"en","value":"CWE-79"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*","versionStartIncluding":"6.0.0","versionEndExcluding":"6.0.3.4","matchCriteriaId":"E4F559E5-D93F-40E5-9630-D7B364B4BED7"}]}]}],"references":[{"url":"https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ","source":"support@hackerone.com","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/904059","source":"support@hackerone.com","tags":["Exploit","Patch","Third Party Advisory"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Mailing List","Third Party Advisory"]},{"url":"https://hackerone.com/reports/904059","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Patch","Third Party Advisory"]}]}}]}