CVE-2015-7225

RubyGems/devise-two-factor CVE-2015-7225: medium 5.3

Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

Action: Upgrade devise-two-factor to 2.0.0 or later.

bundle update devise-two-factor

Affected

Fixed versions

Sources

• osv: GHSA-x489-jjwm-52g7
• https://nvd.nist.gov/vuln/detail/CVE-2015-7225
• https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466
• https://github.com/advisories/GHSA-x489-jjwm-52g7
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2015-7225.yml
• https://github.com/tinfoil/devise-two-factor
• https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md
• https://web.archive.org/web/20210122192452/https://www.securityfocus.com/bid/76789
• http://www.openwall.com/lists/oss-security/2015/06/20/4
• http://www.openwall.com/lists/oss-security/2015/09/06/2
• http://www.openwall.com/lists/oss-security/2015/09/17/2

CVE-2015-7225 · published 2018-08-28T22:34:15Z · modified 2024-12-08T05:44:02.146290Z · JSON