CVE-2019-16109
Medium
Description
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
SeverityMedium
CVSS5.3
Exploit probability—
ProductPlataformatec Devise
PublishedSep 8, 2019
First seenSep 8, 2019
How to fix
Update
- plataformatec devise4.7.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| plataformatec devise | v < 4.7.1 | 4.7.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.