CVE-2021-43177: Improper one time password handling in devise-two-factor

April 11, 2022 (updated April 18, 2022)

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

References

github.com/advisories/GHSA-jm35-h8q2-73mp
github.com/tinfoil/devise-two-factor/issues/106
github.com/tinfoil/devise-two-factor/security/advisories/GHSA-jm35-h8q2-73mp

Code Behaviors & Features

Detect and mitigate CVE-2021-43177 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →