{"action":"Upgrade devise-two-factor to 2.0.0 or later.","affected":[{"fixed":"2.0.0","introduced":"0"}],"component":"devise-two-factor","cve_ids":["CVE-2015-7225"],"ecosystem":"RubyGems","epss":0.02058,"exploited":false,"fixed_versions":["2.0.0"],"ghsa_id":"GHSA-x489-jjwm-52g7","id":"tcs_01M5KEP4V7XCA3QYZHVAGNAVS3","modified_at":"2024-12-08T05:44:02.146290Z","published_at":"2018-08-28T22:34:15Z","references":["https://osv.dev/vulnerability/GHSA-x489-jjwm-52g7","https://nvd.nist.gov/vuln/detail/CVE-2015-7225","https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608","https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466","https://github.com/advisories/GHSA-x489-jjwm-52g7","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2015-7225.yml","https://github.com/tinfoil/devise-two-factor","https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md","https://web.archive.org/web/20210122192452/https://www.securityfocus.com/bid/76789","http://www.openwall.com/lists/oss-security/2015/06/20/4","http://www.openwall.com/lists/oss-security/2015/09/06/2","http://www.openwall.com/lists/oss-security/2015/09/17/2"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-x489-jjwm-52g7","url":"https://osv.dev/vulnerability/GHSA-x489-jjwm-52g7"}],"summary":"Tinfoil Devise-two-factor does not \"burn\" a successfully validated one-time password (OTP)"}