cve.bz

CVE-2021-43177

5.3 mediumEPSS 0.9%

Medium (5.3) in tinfoilsecurity devise-two-factor. EPSS 0.9% chance of exploitation in the next 30 days. Fixed in devise-two-factor 4.0.2.

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
CWE
CWE-254
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-jm35-h8q2-73mpRubyGemsdevise-two-factor<4.0.24.0.2

References

Check your stackJSON