| Package | Affected versions | Patched versions |
|---|---|---|
| devise | < 3.5.4 | 3.5.4 |
| devise | < 3.5.4 | 3.5.4 |
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free