Vulnerabilities

TI-2024-08162 CVE-2024-8796 · GHSA-qjxf-mc72-wjr2

Insufficient Default OTP Shared Secret Length

LOW 28

Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00641 Published 2024-09-17 Fixed in 6.0.0 CWE-331

TI-2021-19191 CVE-2021-43177 · GHSA-jm35-h8q2-73mp

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor…

LOW 26

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval.

CVSS 3.1MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00884 Published 2022-04-11 Fixed in 4.0.2 CWE-254

TI-2015-05998 CVE-2015-7225 · GHSA-x489-jjwm-52g7

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238…

LOW 28

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with…

CVSS 3.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.02058 Published 2017-09-06 Fixed in 2.0.0 CWE-254

Vulnerabilities

Filters

Insufficient Default OTP Shared Secret Length

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor…

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238…