CVE-2015-7225

low-risk

Published 2017-09-06

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.

Do I need to act?

0.65% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 5.3/10 Medium

NETWORK / HIGH complexity

Affected Products (1)

Devise-Two-Factor

Affected Vendors

Tinfoilsecurity

References (12)

Mailing List http://www.openwall.com/lists/oss-security/2015/06/20/4

Mailing List http://www.openwall.com/lists/oss-security/2015/09/17/2

Third Party Advisory http://www.securityfocus.com/bid/76789

Mailing List https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466

Third Party Advisory https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md

Third Party Advisory https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608

Mailing List http://www.openwall.com/lists/oss-security/2015/06/20/4

Mailing List http://www.openwall.com/lists/oss-security/2015/09/17/2

Third Party Advisory http://www.securityfocus.com/bid/76789

Mailing List https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466

Third Party Advisory https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.md

Third Party Advisory https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608

/ 100

low-risk

Severity 17/34 · Moderate

Exploitability 2/34 · Minimal

Exposure 5/34 · Minimal