Time-Based One-Time Password (TOTP) Reuse Affecting devise-two-factor package, versions < 2.0.0
Snyk CVSS
Attack Complexity
High
Confidentiality
High
Threat Intelligence
EPSS
0.23% (62nd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DEVISETWOFACTOR-20239
- published 16 Sep 2015
- disclosed 16 Sep 2015
- credit Viliam Holub
Introduced: 16 Sep 2015
CVE-2015-7225 Open this link in a new tabOverview
devise-two-factor is a two-factor authentication addition to devise.
Affected versions do not mark used TOTP (Time-Based One-Time Password) verification codes once used, and allow their reuse during the timestep period of the code. This can be exploited by an attacker with knowledge of the authentication credentials AND access to the TOTP verification code that was just used.