Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)

TRUNG BÌNH 5.3CVE-2015-7225 · GHSA-x489-jjwm-52g7 · Công bố 06/09/2017 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2015-7225 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng devise-two-factor, devise-two-factor (tinfoilsecurity).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 2.1%, cao hơn 81.4% các lỗ hổng khác.
Cách xử lý: cập nhật lên 2.0.0 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
devise-two-factor RubyGems	`< 2.0.0`	`2.0.0`
devise-two-factor tinfoilsecurity	`≤ 1.1.0`	Chưa có bản vá

Mô tả

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow RFC 6238 § 5.2 and does not "burn" a successfully validated one-time password (aka OTP), which allows physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or "shoulder surfing", and replaying the OTP in the current time-step.

Mô tả của NVD

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.