CVE-2015-7225: Medium severity tinfoilsecurity devise two factor vulnerability
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7225?
CVE-2015-7225 has a medium to high severity due to its potential to allow unauthorized access through the exploitation of OTPs.
How do I fix CVE-2015-7225?
To fix CVE-2015-7225, upgrade to ruby-devise-two-factor version 3.1.0-2 or 4.0.2-1.
Who is affected by CVE-2015-7225?
CVE-2015-7225 affects users of Tinfoilsecurity Devise-two-factor versions prior to 2.0.0.
What does CVE-2015-7225 exploit?
CVE-2015-7225 exploits the failure to properly validate OTPs as described in RFC 6238.
Can CVE-2015-7225 be exploited remotely?
Yes, CVE-2015-7225 can be exploited remotely by attackers with access to the target user's login credentials.