GHSA-746g-3gfp-hfhw CVE-2015-8314
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 0.62%
- Chance of exploitation in the next 30 days. Higher than 49.65% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- CWE-312 Cleartext Storage of Sensitive Information
- Fix
3.5.4- Upgrade devise to this version or later
Description
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| devise | < 3.5.4 |
3.5.4 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
devise RubyGems → 3.5.4
- bundler
bundle update devise # Gemfile: gem "devise", ">= 3.5.4"
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-288: Authentication Bypass Using an Alternate Path or Channel
The product requires authentication, but the product has an alternate path or channel that does not require authentication.
How to prevent it
- Architecture and Design: Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.
CWE-312: Cleartext Storage of Sensitive Information
The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
How to prevent it
- Implementation, System Configuration, Operation: When storing data in the cloud (e.g., S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to encrypt the data at rest. [REF-1297] [REF-1299] [REF-1301]
- Implementation, System Configuration, Operation: In some systems/environments such as cloud, the use of "double encryption" (at both the software and hardware layer) might be required, and the developer might be solely responsible for both layers, instead of shared responsibility with the administrator of the broader system/environment.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-jp94-3292-c3xv Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler | Medium | Also affects devise |
| GHSA-57hq-95w6-v4fc Devise has a confirmable "change email" race condition permits user to confirm email they have no access to | Medium | Also affects devise |
| GHSA-fcjw-8rhj-gwwc Authentication Bypass in Devise | Medium | Also affects devise |
| GHSA-73rf-6mrf-759q devise Time-of-check Time-of-use Race Condition vulnerability | Medium | Also affects devise |
| GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries | Medium | Also affects devise |
| GHSA-vc32-4gwf-77xp Nginx UI: OTP secure-session step-up can be bypassed via MCP configuration tools | High | Same weakness, CWE-288 |
| GHSA-hxcx-9h4f-42xx Snipe-IT: 2FA bypass via the API token flow | High | Same weakness, CWE-288 |
| GHSA-pf83-w3f9-8m37 n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessions | Medium | Same weakness, CWE-288 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor