devise (RubyGems)
Advisories
9
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 5.0.4 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update devise # Gemfile: gem "devise", ">= 5.0.4"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-jp94-3292-c3xv Devise has an Open Redirect via Unvalidated `request.referrer` in Timeoutable Session Timeout Handler |
Medium EPSS 0.24% |
< 5.0.4 | 5.0.4 |
| GHSA-57hq-95w6-v4fc Devise has a confirmable "change email" race condition permits user to confirm email they have no access to |
Medium EPSS 0.29% |
< 5.0.3 | 5.0.3 |
| GHSA-746g-3gfp-hfhw Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie |
High EPSS 0.62% |
< 3.5.4 | 3.5.4 |
| GHSA-fcjw-8rhj-gwwc Authentication Bypass in Devise |
Medium EPSS 1.83% |
< 4.7.1 | 4.7.1 |
| GHSA-73rf-6mrf-759q devise Time-of-check Time-of-use Race Condition vulnerability |
Medium EPSS 1.56% |
< 4.6.0 | 4.6.0 |
| GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries |
Medium EPSS 14.13% |
>= 2.2.0, < 2.2.3 | 2.2.3 |
| GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries |
Medium EPSS 14.13% |
>= 2.1.0, < 2.1.3 | 2.1.3 |
| GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries |
Medium EPSS 14.13% |
>= 2.0.0, < 2.0.5 | 2.0.5 |
| GHSA-jxhw-mg8m-2pj8 Devise does not properly perform type conversion when performing database queries |
Medium EPSS 14.13% |
>= 1.5.0, < 1.5.4 | 1.5.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor