Vulnerabilities > CVE-2024-21654 - Unspecified vulnerability in Rubygems Rubygems.Org 20230814

047910
CVSS 9.8 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
low complexity
rubygems
critical
NVD
Published: 2024-01-12
Updated: 2024-11-21

Summary

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Vulnerable Configurations

Part Description Count
Application
Rubygems
2

References