Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdnOW0tZ3czaC1oZzgz

field_test gem contains injection vulnerability

The field_test gem 0.3.0 for Ruby has unvalidated input. A method call that is expected to return a value from a certain set of inputs can be made to return any input, which can be dangerous depending on how applications use it. If an application treats arbitrary variants as trusted, this can lead to a variety of potential vulnerabilities like SQL injection or cross-site scripting (XSS).

Permalink: https://github.com/advisories/GHSA-wg9m-gw3h-hg83
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLXdnOW0tZ3czaC1oZzgz
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 5 years ago
Updated: over 1 year ago

CVSS Score: 5.3
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Percentage: 0.00211
EPSS Percentile: 0.58689

Identifiers: GHSA-wg9m-gw3h-hg83, CVE-2019-13146
References:

• https://github.com/ankane/field_test/issues/17
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/field_test/CVE-2019-13146.yml
• https://web.archive.org/web/20210115194802/http://www.securityfocus.com/bid/109114
• https://web.archive.org/web/20220526020623/https://nvd.nist.gov/vuln/detail/CVE-2019-13146
• https://github.com/advisories/GHSA-wg9m-gw3h-hg83

Repository: https://github.com/ankane/field_test
Blast Radius: 11.4

Affected Packages