1. Home
  2. CVE Database
  3. CVE-2024-21654
MEDIUM · 4.8

CVE-2024-21654

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workar...

Vulnerability Description

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

CVSS Score

4.8

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
NONE

Affected Products

VendorProductVersions
RubygemsRubygems.Org< 2024-01-08

Related Weaknesses (CWE)

CWE-306CWE-287

References

FAQ

What is CVE-2024-21654?

CVE-2024-21654 is a vulnerability with a CVSS score of 4.8 (MEDIUM). Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workar...

How severe is CVE-2024-21654?

CVE-2024-21654 has been rated MEDIUM with a CVSS base score of 4.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2024-21654?

Check the references section above for vendor advisories and patch information. Affected products include: Rubygems Rubygems.Org.