cve.bz

CVE-2015-7225

5.3 mediumEPSS 2.1%

Medium (5.3) in tinfoilsecurity devise-two-factor. EPSS 2.1% chance of exploitation in the next 30 days. Fixed in devise-two-factor 2.0.0.

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.

Severity

CVSS 3.0

5.3 medium
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE
CWE-254
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-x489-jjwm-52g7RubyGemsdevise-two-factor<2.0.02.0.0

References

Check your stackJSON