CVE-2024-21654

Published: Jan 12, 2024Modified: Nov 21, 2024

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Affected (1)

Products: Rubygems: Rubygems.org

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Rubygems Rubygems.org	Before 2024-01-08

Related CWEs

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (4)

https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565

Source: security-advisories@github.com

Patch

https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2

Source: security-advisories@github.com

PatchVendor Advisory

https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.