Riskcovery

CVE-2024-21654

rubygems.org MFA Bypass through password reset function could allow account takeover

State
Published
Severity
4.8 Medium
Published
Jan 12, 2024
Updated
Oct 24, 2024
Reserved
Dec 29, 2023

Read the record on cve.org

Description

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Scores

CVSSScoreVectorSource
3.14.8 MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NGitHub_M

Weaknesses

  • CWE-287 Improper Authentication
  • CWE-306 Missing Authentication for Critical Function

Affected Products

ProductVersions
rubygems.orgrubygems
  • < commit 0b3272aAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.