RubyGems/devise_invitable CVE-2023-48220: medium 5.7, EPSS 0.79%
Possibility to circumvent the invitation token expiry period
Action: Upgrade devise_invitable to 2.0.9 or later.
bundle update devise_invitableAffected
| introduced | fixed | last affected |
|---|---|---|
| 0.4.rc3 | 2.0.9 | - |
Fixed versions
| 2.0.9 |
Sources
- osv: GHSA-w3q8-m492-4pwp#RubyGems/devise_invitable
- https://github.com/decidim/decidim/security/advisories/GHSA-w3q8-m492-4pwp
- https://nvd.nist.gov/vuln/detail/CVE-2023-48220
- https://github.com/decidim/decidim/commit/073e60e2e4224dd81815a784002ebba30f2ebb34
- https://github.com/decidim/decidim/commit/b12800717a689c295a9ea680a38ca9f823d2c454
- https://github.com/scambra/devise_invitable/commit/94d859c7de0829bf63f679ae5dd3cab2b866a098
- https://github.com/decidim/decidim
- https://github.com/decidim/decidim/blob/d2d390578050772d1bdb6d731395f1afc39dcbfc/decidim-core/config/initializers/devise.rb#L134
- https://github.com/decidim/decidim/releases/tag/v0.26.9
- https://github.com/decidim/decidim/releases/tag/v0.27.5
- https://github.com/decidim/decidim/releases/tag/v0.28.0
- https://github.com/scambra/devise_invitable/blob/41f58970ff76fb64382a9b9ea1bd530f7c3adab2/lib/devise_invitable/models.rb#L198
CVE-2023-48220 · published · modified · JSON