GitHub Advisoryadvisory · RubyGems

GHSA-fcjw-8rhj-gwwc Authentication Bypass in Devise

MEDIUM Published 2019-09-11 Modified 2023-01-23 Official page ↗
Aliases
CVE-2019-16109
Ecosystem
RubyGems
Packages
devise
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-284
Reviewed
2019-09-11

Affected packages

• RubyGems devise: < 4.7.1 → fixed in 4.7.1

Description

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)

Related

Alias · CVE (1)

  • CVE-2019-16109 An issue was discovered in Plataformatec Devise before 4.7.1. vulnerability

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References