by Kastro
Paper/Archive/CVE-2024-21654

CVE-2024-21654

rubygems rubygems.org — rubygems.org MFA Bypass through password reset function could allow account takeover

EPSS 0.5%CVSS 9.8
critical.is priorityof 100
38
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 41.4.414 × 208.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Affected

ProductAffectedFixed inSource
rubygems.org< commit 0b3272a–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)4.8CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2refgithub.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565