CVE-2024-21654

CVSS V2 None CVSS V3 None

Description

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Overview

CVE ID
CVE-2024-21654

Assigner
GitHub_M

Vulnerability Status
PUBLISHED

Published Version
2024-01-12T20:59:43.094Z

Last Modified Date
2024-01-12T20:59:43.094Z

Weakness Enumerations

CWE	URL
CWE-287	http://cwe.mitre.org/data/definitions/287.html

References

Reference URL	Reference Tags
https://github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2	x_refsource_CONFIRM
https://github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565	x_refsource_MISC

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2024-21654
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21654

History

Created	Old Value	New Value	Data Type	Notes
2024-06-26 15:08:37				Added to TrackCVE