Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
rubygemsRubySecRUBY:DEVISE-2019-5421
HistoryFeb 06, 2019 - 9:00 p.m.

Devise Gem for Ruby Time-of-check Time-of-use race condition with lockable module

2019-02-0621:00:00
RubySec
github.com
8

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JSON

Devise ruby gem before 4.6.0 when the lockable module is used is vulnerable to a
time-of-check time-of-use (TOCTOU) race condition due to increment_failed_attempts
within the Devise::Models::Lockable class not being concurrency safe.

Affected configurations

Vulners
Node
rubydeviseRange≤4.6.0
VendorProductVersionCPE
rubydevise*cpe:2.3:a:ruby:devise:*:*:*:*:*:*:*:*

Related

nvd 1
cve 1
prion 1
debiancve 1
cvelist 1
ubuntucve 1
osv 2
veracode 1
github 1
nvd
nvd
CVE-2019-5421
2019-04-03 15:29:01
cve
cve
CVE-2019-5421
2019-04-03 15:29:01
prion
prion
Design/Logic Flaw
2019-04-03 15:29:00
debiancve
debiancve
CVE-2019-5421
2019-04-03 15:29:01
cvelist
cvelist
CVE-2019-5421
2019-04-03 14:21:37
ubuntucve
ubuntucve
CVE-2019-5421
2019-04-03 00:00:00
osv
osv
devise Time-of-check Time-of-use Race Condition vulnerability
2019-03-19 18:03:25
CVE-2019-5421
2019-04-03 15:29:01
veracode
veracode
Time-of-check To Time-of-Use (TOCTOU)
2019-02-14 03:01:34
github
github
devise Time-of-check Time-of-use Race Condition vulnerability
2019-03-19 18:03:25

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

JSON
Related for RUBY:DEVISE-2019-5421
nvd1cve1prion1debiancve1cvelist1ubuntucve1osv2veracode1github1