CVE-2020-16252.yml

---
gem: field_test
cve: 2020-16252
ghsa: w542-cpp9-r3g7
url: https://github.com/ankane/field_test/issues/28
title: CSRF Vulnerability with Non-Session Based Authentication
date: 2020-08-04
description: |
  The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods.

  ## Impact
  The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods,
  like basic authentication. Session-based authentication methods (like Devise's default
  authentication) are not affected.

  A CSRF attack works by getting an authorized user to visit a malicious website and then
  performing requests on behalf of the user. In this instance, a single endpoint is affected,
  which allows for changing the variant assigned to a user.
cvss_v3: 4.3
unaffected_versions:
  - "< 0.2.0"
patched_versions:
  - ">= 0.4.0"