Weakness (CWE)
CWE-254: 7PK - Security Features
Category Incomplete Mapping prohibited
Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Source: MITRE CWE-254
1 result · Clear filters · Feed
-
Medium 5.3
Improper one time password handling in devise-two-factor
As a result of an incomplete fix for CVE-2015-7225, in versions of devise-two-factor prior to 4.0.2 it is possible to reuse a One-Time-Password (OTP) for one (and only one) immediately trailing interval. CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/…