CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
| Software | From | Fixed in |
|---|---|---|
devise
|
- | 3.5.4 |
| heartcombo / devise | - | 3.5.4 |
- http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise
- http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/
- https://github.com/advisories/GHSA-746g-3gfp-hfhw
- https://github.com/heartcombo/devise/commit/c92996646aba2d25b2c3e235fe0c4f1a84b70d24
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/devise/CVE-2015-8314.yml
- https://rubysec.com/advisories/CVE-2015-8314
- https://rubysec.com/advisories/CVE-2015-8314/
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime