PT-2024-19001 · Unknown · Rubygems.Org

Martinemde · Published 2024-01-12 · Updated 2024-10-24 · CVE-2024-21654

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Rubygems.org (affected versions not specified)

Description The issue concerns a workaround on the forgotten password form of Rubygems.org, which allows an attacker to bypass the Multi-Factor Authentication (MFA) requirement. Normally, users with MFA enabled would be protected from account takeover in the case of email account takeover. However, this vulnerability enables an attacker to take over the account.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2024-21654

GHSA-4V23-VJ8H-7JP2

Affected Products

Rubygems.Org

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/21xxx/CVE-2024-21654.json · Exploit
• https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2 · Vendor Advisory
• https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565 · Patch
• https://osv.dev/vulnerability/CVE-2024-21654 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21654 · Security Note
• https://twitter.com/CVEnew/status/1745916998830207237 · Twitter Post
• https://t.me/cvenotify/68246 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745956571232804881 · Twitter Post
• https://t.me/cvenotify/99385 · Telegram Post