Description
Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Plataformatec | Devise ruby gem | affected |
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2019-0372 | Plataformatec Devise version 4.5.0 and earlier, using the lockable module contains a CWE-367 vulnerability in The `Devise::Models::Lockable` class, more specifically at the `#increment_failed_attempts` method. File location: lib/devise/models/lockable.rb that can result in Multiple concurrent requests can prevent an attacker from being blocked on brute force attacks. This attack appear to be exploitable via Network connectivity - brute force attacks. This vulnerability appears to have been fixed in 4.6.0 and later. |
 Github GHSA |
GHSA-73rf-6mrf-759q | devise Time-of-check Time-of-use Race Condition vulnerability |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: hackerone
Published:
Updated: 2024-08-04T19:54:53.557Z
Reserved: 2019-01-04T00:00:00.000Z
Link: CVE-2019-5421
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-04-03T15:29:01.663
Modified: 2024-11-21T04:44:54.277
Link: CVE-2019-5421
Redhat
No data.
OpenCVE Enrichment
No data.