CVE-2024-21654: falha de média gravidade em rubygems.org
rubygems.org MFA Bypass through password reset function could allow account takeover
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.5%
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Produtos afetados
rubygems · rubygems.orgCVEs relacionadas — rubygems.org
No mesmo produto, das mais perigosas para as menos.
CVE-2022-29176CRITICALUnauthorized gem takeover for some gems on rubygems.orgEPSS 1.9%CVE-2022-29218HIGHUnauthorized takeover for new versions of some platform-specific gemsEPSS 1.3%CVE-2022-36073HIGHRubyGems allows creation of users with arbitrary unverified emailsEPSS 1.0%CVE-2024-35221MEDIUMDenial of service when publishing a package on rubygems.orgEPSS 0.5%CVE-2023-40165HIGHUnauthorized gem replacement for full names ending in numbers on rubygems.orgEPSS 0.5%