Количество 4
Количество 4
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.
CVE-2015-7225
Tinfoil Devise-two-factor before 2.0.0 does not strictly follow sectio ...
GHSA-x489-jjwm-52g7
Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2015-7225 Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step. | CVSS3: 5.3 | 2% Низкий | почти 9 лет назад |
 | CVE-2015-7225 Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step. | CVSS3: 5.3 | 2% Низкий | почти 9 лет назад |
| CVE-2015-7225 Tinfoil Devise-two-factor before 2.0.0 does not strictly follow sectio ... | CVSS3: 5.3 | 2% Низкий | почти 9 лет назад |
| GHSA-x489-jjwm-52g7 Tinfoil Devise-two-factor does not "burn" a successfully validated one-time password (OTP) | CVSS3: 5.3 | 2% Низкий | около 8 лет назад |
Уязвимостей на страницу