CVE-2021-43177 Improper one time password handling in devise-two-factor
Attackers can reuse a One-Time-Password for one trailing interval, bypassing two-factor authentication in the devise-two-factor Ruby library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43177?
CVE-2021-43177 is a medium-severity vulnerability in Tinfoil devise-two-factor, published on 11 Apr 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-254
Which versions are affected by CVE-2021-43177?
2 open source packages ship an affected version, including devise-two-factor. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
devise-two-factor RubyGems | All versions | 4.0.2 |
devise-two-factor RubyGems | All versions | 4.0.2 |
Products include Tinfoilsecurity Devise-Two-Factor.
How do I fix CVE-2021-43177?
Upgrade devise-two-factor to 4.0.2 or later.
Is CVE-2021-43177 being exploited?
There is no known exploitation of CVE-2021-43177 in the wild and no public exploit code.
Other vulnerabilities in Tinfoil devise-two-factor
Sources
Also known as DEBIAN-CVE-2021-43177, GHSA-jm35-h8q2-73mp, UBUNTU-CVE-2021-43177.