CVE-2015-7225

Name: CVE-2015-7225
Creator: NVD / NIST
Published: 2017-09-06T21:29:00.957+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.78%

Last modified Jun 17, 2026

CVE-2015-7225 is a vulnerability of currently unknown severity. Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.. EPSS estimates a 1.78% chance of exploitation in the next 30 days.

Description

Tinfoil Devise-two-factor before 2.0.0 does not strictly follow section 5.2 of RFC 6238 and does not "burn" a successfully validated one-time password (aka OTP), which allows remote or physically proximate attackers with a target user's login credentials to log in as said user by obtaining the OTP through performing a man-in-the-middle attack between the provider and verifier, or shoulder surfing, and replaying the OTP in the current time-step.

Metrics

EPSS Probability

1.78%

75.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-254

Affected Software

Vendor	Product	Versions
Tinfoilsecurity	Devise-Two-Factor	<= 1.1.0

References

http://www.openwall.com/lists/oss-security/2015/06/20/4Mailing List, VDB Entry
http://www.openwall.com/lists/oss-security/2015/09/17/2Mailing List, VDB Entry
http://www.securityfocus.com/bid/76789Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466Mailing List, Third Party Advisory
https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.mdThird Party Advisory
https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/06/20/4Mailing List, VDB Entry
http://www.openwall.com/lists/oss-security/2015/09/17/2Mailing List, VDB Entry
http://www.securityfocus.com/bid/76789Third Party Advisory, VDB Entry
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=798466Mailing List, Third Party Advisory
https://github.com/tinfoil/devise-two-factor/blob/master/UPGRADING.mdThird Party Advisory
https://github.com/tinfoil/devise-two-factor/issues/45#issuecomment-139335608Third Party Advisory

Timeline

Published: Sep 6, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2015-7225?

How severe is CVE-2015-7225?

Severity scoring for CVE-2015-7225 is pending analysis. The EPSS model estimates a 1.78% probability of exploitation in the next 30 days.

How do I fix CVE-2015-7225?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2015-7225?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST