Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

field_test

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.3RubyGemsPublished

    Field Test CSRF vulnerability

    CVE-2020-16252 · GHSA-w542-cpp9-r3g7

    Affected
    • RubyGems field_test >= 0.2.0, <= 0.3.2
    Fixed in
    0.4.0· Vendor fix available
    Issue
    The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2. Impact The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected. A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user. All users running an affected release should upgrade immediately. Technical Details Field Test uses the protectfromforgery method from Rails to prevent CSRF. However, this defaults to :nullsession, which has no effect on non-session based authentication methods. This has been changed to protectfromforgery with: :exception.

    Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. Medium, CVSS 5.3RubyGemsPublished

    field_test gem contains injection vulnerability

    CVE-2019-13146 · GHSA-wg9m-gw3h-hg83

    Affected
    • RubyGems field_test >= 0.3.0, <= 0.3.0
    Fixed in
    0.3.1· Vendor fix available
    Issue
    The fieldtest gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).

    Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →