What is CVE-2021-43177?

CVE-2021-43177 is a medium-severity vulnerability in Tinfoil Devise-Two-Factor, classified under CWE-254. CVSS score: 5.3/10. Published 2022-04-11.

How severe is CVE-2021-43177?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Tinfoil Devise-Two-Factor

CVE-2021-43177

As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)

EPSS: 0.008 (54.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Tinfoil Devise-two-factor — versions < 4.0.2
Tinfoilsecurity Devise-two-factor

Weakness classification (CWE)

CWE-254

References

disclosure@synopsys.com (Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2021-43177?: CVE-2021-43177 is a medium-severity vulnerability in Tinfoil Devise-Two-Factor, classified under CWE-254. CVSS score: 5.3/10. Published 2022-04-11.
How severe is CVE-2021-43177?: Medium severity. CVSS v3 base score is 5.3 out of 10.