CVE-2015-8314
ruby-devise: The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obt...
CVE-2015-8314 is fixed in ruby-devise on 1 platform by DEBIAN-CVE-2015-8314 (version 3.5.6-2), released December 12, 2023. It is not reported as exploited. Patch Radar priority: High.
High
CVSS
7.5
high
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0062
49th percentile
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| ruby-devise · Debian 12.15 (bookworm) | 3.5.6-2 | DEBIAN-CVE-2015-8314 | Dec 12, 2023 |