PT-2017-7164 · Tinfoil · Tinfoil Devise-Two-Factor

F3Ndot · Publicado 2017-09-06 · Atualizado 2018-08-28 · CVE-2015-7225

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tinfoil Devise-two-factor versions prior to 2.0.0

Description The issue arises from not strictly following section 5.2 of RFC 6238, which leads to not "burning" a successfully validated one-time password (OTP). This allows attackers with a target user's login credentials to log in as the user by obtaining the OTP through man-in-the-middle attacks or shoulder surfing and then replaying the OTP in the current time-step.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Exploit

Correção

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

CVE-2015-7225

GHSA-X489-JJWM-52G7

Produtos afetados

Tinfoil Devise-Two-Factor

Referências · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2015-7225.yml · Exploit
• https://github.com/tinfoil/devise-two-factor · Nota
• https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608 · Nota
• https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7225 · Aviso do Fabricante
• https://web.archive.org/web/20210122192452/https://securityfocus.com/bid/76789 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-7225 · Nota de Segurança
• http://securityfocus.com/bid/76789 · Nota
• https://github.com/advisories/GHSA-x489-jjwm-52g7 · Nota
• https://security-tracker.debian.org/tracker/CVE-2015-7225 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7225 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-x489-jjwm-52g7 · Aviso do Fabricante
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466 · Nota
• https://ubuntu.com/security/CVE-2015-7225 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2015/09/06/2 · Nota