Improper authorization control for web services In devise
Description
Authentication Bypass in Devise An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 rubygems | 4.7.1 |
Aliases
1. 2. 3. 4.
References
1. 2. 3. 4.