CVE-2015-8314: High severity devise vulnerability
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
Other sources
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What are the security implications of CVE-2015-8314?
CVE-2015-8314 allows attackers to gain unauthorized access by stealing the same 'Remember me' cookie used across all devices.
How do I fix CVE-2015-8314?
To fix CVE-2015-8314, upgrade Devise to version 3.5.4 or later where this vulnerability is addressed.
What versions of Devise are affected by CVE-2015-8314?
CVE-2015-8314 affects all Devise versions prior to 3.5.4.
How does the 'Remember me' feature work in CVE-2015-8314?
In CVE-2015-8314, the 'Remember me' feature generates a static cookie shared across all devices, which is a security risk.
Why is it important to patch CVE-2015-8314 quickly?
Patching CVE-2015-8314 is crucial because it mitigates the risk of unauthorized access through exploited static cookies.