CVE-2020-16252
Field Test CSRF vulnerability
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
- Record
CVE-2020-16252- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
CVE List No score
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
- Record
CVE-2020-16252- Updated
- 2026-11-02
EUVDEUVD-2020-0646 No score
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
- Record
EUVD-2020-0646- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-w542-cpp9-r3g7
Field Test CSRF vulnerability
The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.
Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.
A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.
All users running an affected release should upgrade immediately.
Technical Details
Field Test uses the protect_from_forgery method from Rails to prevent CSRF. However, this defaults to :null_session, which has no effect on non-session based authentication methods. This has been changed to protect_from_forgery with: :exception.
- Record
GHSA-w542-cpp9-r3g7- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
OSV
The Field Test gem 0.2.0 through 0.3.2 for Ruby allows CSRF.
- Record
CVE-2020-16252- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-w542-cpp9-r3g7
Field Test CSRF vulnerability
The Field Test dashboard is vulnerable to cross-site request forgery (CSRF) with non-session based authentication methods in versions v0.2.0 through v0.3.2.
Impact
The Field Test dashboard is vulnerable to CSRF with non-session based authentication methods, like basic authentication. Session-based authentication methods (like Devise's default authentication) are not affected.
A CSRF attack works by getting an authorized user to visit a malicious website and then performing requests on behalf of the user. In this instance, a single endpoint is affected, which allows for changing the variant assigned to a user.
All users running an affected release should upgrade immediately.
Technical Details
Field Test uses the protect_from_forgery method from Rails to prevent CSRF. However, this defaults to :null_session, which has no effect on non-session based authentication methods. This has been changed to protect_from_forgery with: :exception.
- Record
GHSA-w542-cpp9-r3g7- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Weakness
- CWE-352
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
field_testRubyGems |
0.2.0 to 0.3.2 | 0.4.0 |
field_testRubyGems |
0.2.0 up to 0.4.0, plus listed versions 0.2.10.2.20.2.30.2.40.3.00.3.10.3.2 |
0.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-16252 is a medium vulnerability (CVSS 4.3) in Field Test Project Test, published August 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.43%, the 37th percentile. Fixed in field_test 0.4.0.
References
github.com/ankane/field_test
nvd.nist.gov/vuln/detail/CVE-2020-16252