CVE-2024-21654: rubygems.org MFA Bypass through password reset function could allow account takeover
Vulnerability summary
CVE-2024-21654 is a critical (CVSS 9.8) Improper Authentication vulnerability in rubygems rubygems.org. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40.4% of scored vulnerabilities.
Timeline
- 12-01-2024PublishedVulnerability first disclosed.
- 24-10-2024Last modifiedVulnerability information updated.
Description
Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.
CVSS metrics
2 scores · 2 sources · 1 version- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.48%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.48% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Rubygems1 product
- rubygems.org< commit 0b3272a | < 2024-01-08
1 vendor · 1 product
References
2 links- github.com/rubygems/rubygems.org/security/advisories/GHSA-4v23-vj8h-7jp2X Refsource CONFIRMPatchVendor Advisory
- github.com/rubygems/rubygems.org/commit/0b3272ac17b45748ee0d1867c49867c7deb26565X Refsource MISCPatch