diff --git a/advisories/github-reviewed/2023/01/GHSA-746g-3gfp-hfhw/GHSA-746g-3gfp-hfhw.json b/advisories/github-reviewed/2023/01/GHSA-746g-3gfp-hfhw/GHSA-746g-3gfp-hfhw.json index 6629fa962ee..6a9c7a70ed4 100644 --- a/advisories/github-reviewed/2023/01/GHSA-746g-3gfp-hfhw/GHSA-746g-3gfp-hfhw.json +++ b/advisories/github-reviewed/2023/01/GHSA-746g-3gfp-hfhw/GHSA-746g-3gfp-hfhw.json @@ -1,12 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-746g-3gfp-hfhw", - "modified": "2023-01-26T23:54:07Z", + "modified": "2023-09-05T21:57:50Z", "published": "2023-01-26T23:54:07Z", "aliases": [ "CVE-2015-8314" ], - "summary": "Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie", + "summary": "Devise Gem for Ruby Unauthorized Access Using \"Remember Me\" Cookie", "details": "Devise version before 3.5.4 uses cookies to implement a \"Remember me\" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.\n", "severity": [ @@ -17,6 +17,11 @@ "ecosystem": "RubyGems", "name": "devise" }, + "ecosystem_specific": { + "affected_functions": [ + "" + ] + }, "ranges": [ { "type": "ECOSYSTEM", @@ -52,7 +57,7 @@ ], "database_specific": { "cwe_ids": [ - + "CWE-288" ], "severity": "MODERATE", "github_reviewed": true,