Tinfoilsecurity Devise-Two-Factor
3 CVEs affecting Tinfoilsecurity Devise-Two-Factor. Latest disclosed: 2024-09-17. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-8796 | Medium | 5.3 | 2024-09-17 | Under the default configuration, Devise-Two-Factor versions >= 2.2.0 & < 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum de… |
CVE-2021-43177 | Medium | 5.3 | 2022-04-11 | As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (… |
CVE-2015-7225 | Medium | 5.3 | 2017-09-06 | Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP… |