En resumen
- CVE-2015-7225 es una vulnerabilidad MEDIO (CVSS 5.3) que afecta a devise-two-factor, devise-two-factor (tinfoilsecurity).
- Probabilidad de explotación en los próximos 30 días (EPSS): 2.1%, mayor que el 81.4% de las vulnerabilidades.
- Solución: actualizar a 2.0.0 o posterior.
Description
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password (aka OTP), which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or "shoulder surfing", and replaying the OTP in the current time-step.
NVD description
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Más vulnerabilidades de devise-two-factor
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free