As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
References
Link | Resource |
---|---|
https://github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp | Third Party Advisory |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: SNPS
Published: 2022-04-11T19:37:40
Updated: 2022-04-11T19:37:40
Reserved: 2021-11-01T00:00:00
Link: CVE-2021-43177
JSON object: View
NVD Information
Status : Analyzed
Published: 2022-04-11T20:15:16.037
Modified: 2022-04-18T13:29:56.057
Link: CVE-2021-43177
JSON object: View
Redhat Information
No data.