PT-2017-7164 · Tinfoil · Tinfoil Devise-Two-Factor

F3Ndot · Published 2017-09-06 · Updated 2018-08-28 · CVE-2015-7225

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tinfoil Devise-two-factor versions prior to 2.0.0

Description The issue arises from not strictly following section 5.2 of RFC 6238, which leads to not "burning" a successfully validated one-time password (OTP). This allows attackers with a target user's login credentials to log in as the user by obtaining the OTP through man-in-the-middle attacks or shoulder surfing and then replaying the OTP in the current time-step.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Exploit

Fix

Weakness Enumeration

CWE-254

Related Identifiers

CVE-2015-7225

GHSA-X489-JJWM-52G7

Affected Products

Tinfoil Devise-Two-Factor

References · 19

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise-two-factor/CVE-2015-7225.yml · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2015-7225 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-7225 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2015-7225 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-7225 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x489-jjwm-52g7 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-7225 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2015-7225 · Security Note
• https://osv.dev/vulnerability/CVE-2015-7225 · Vendor Advisory
• https://github.com/tinfoil/devise-two-factor · Note
• https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608 · Note
• https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md · Note
• https://web.archive.org/web/20210122192452/https://securityfocus.com/bid/76789 · Note
• http://securityfocus.com/bid/76789 · Note
• https://github.com/advisories/GHSA-x489-jjwm-52g7 · Note