MEDIUM5.3

GHSA-fcjw-8rhj-gwwc

Authentication Bypass in Devise

Quick fix

GHSA-fcjw-8rhj-gwwc — devise: upgrade to the fixed version with the command below.

bundle update devise

Details

An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/devise

Introduced in: 0Fixed in: 4.7.1

Fixbundle update devise

References

https://nvd.nist.gov/vuln/detail/CVE-2019-16109[ADVISORY]
https://github.com/plataformatec/devise/issues/5071[WEB]
https://github.com/plataformatec/devise/pull/5132[WEB]
https://github.com/plataformatec/devise[PACKAGE]
https://github.com/plataformatec/devise/compare/v4.7.0...v4.7.1[WEB]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/CVE-2019-16109.yml[WEB]