Lucene search

CVE-2021-28680

🗓️ 07 Dec 2021 21:08:15Reported by mitreType

cve🔗 web.nvd.nist.gov👁 52 Views🌐 3 Media mentions

The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used

Reporter	Title	Published	Views	Family All 9
Prion	Code injection	7 Dec 202121:15	–	prion
Cvelist	CVE-2021-28680	7 Dec 202120:32	–	cvelist
CNVD	Alexandr Korsak Devise Masquerade has an unspecified vulnerability	8 Dec 202100:00	–	cnvd
OSV	Improper Privilege Management in devise_masquerade	8 Dec 202119:55	–	osv
OSV	CVE-2021-28680	7 Dec 202121:15	–	osv
NVD	CVE-2021-28680	7 Dec 202121:15	–	nvd
RubySec	Improper Privilege Management in devise_masquerade	7 Dec 202121:00	–	rubygems
Github Security Blog	Improper Privilege Management in devise_masquerade	8 Dec 202119:55	–	github
Veracode	Man-in-the-Middle (MitM)	8 Dec 202103:32	–	veracode

Nvd

Node

devise_masquerade_project devise_masqueradeRange<1.3.0ruby

Source	Link
github	www.github.com/oivoodoo/devise_masquerade/issues/83
labanskoller	www.labanskoller.se/blog/2021/03/23/the-devise-extension-that-peeled-off-one-layer-of-the-security-onion-cve-2021-28680/

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

07 Dec 2021 21:15Current

8.0High risk

Vulners AI Score8.0

CVSS26.8

CVSS38.1

EPSS0.003