Merge pull request #249 from tute/master

reedloden · reedloden · commit b08435d92977 · 2016-04-01T11:21:44.000-07:00
Add CVE-2016-3098 for administrate gem
diff --git a/gems/administrate/CVE-2016-3098.yml b/gems/administrate/CVE-2016-3098.yml
@@ -0,0 +1,14 @@
+---
+gem: administrate
+cve: 2016-3098
+title: Cross-site request forgery (CSRF) vulnerability in administrate gem
+date: 2016-04-01
+url: http://seclists.org/oss-sec/2016/q2/0
+
+description: >-
+  `Administrate::ApplicationController` actions didn't have CSRF
+  protection. Remote attackers can hijack user's sessions and use any
+  functionality that administrate exposes on their behalf.
+
+patched_versions:
+  - ">= 0.1.5"
