Tinfoilsecurity

Records3All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high0CVSS 7.0–8.9

Exploited now

Tinfoilsecurity records in CISA KEV

No Tinfoilsecurity vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Devise-two-factor 3 records LOW

Records

3 records in Devise-two-factor · all components

TI-2024-08162 CVE-2024-8796 · GHSA-qjxf-mc72-wjr2

Insufficient Default OTP Shared Secret Length

LOW 28

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00641 Published 2024-09-17 Fixed in 6.0.0 CWE-331

TI-2015-05998 CVE-2015-7225 · GHSA-x489-jjwm-52g7

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238…

LOW 28

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with…

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02058 Published 2017-09-06 Fixed in 2.0.0 CWE-254

TI-2021-19191 CVE-2021-43177 · GHSA-jm35-h8q2-73mp

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor…

LOW 26

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00884 Published 2022-04-11 Fixed in 4.0.2 CWE-254

Open these records in search →

Critical	0
High	0
Medium	3
Low	0
No CVSS	0