CVE-2015-8314

high

Description

The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.

References

Advisories
More

https://github.com/advisories/GHSA-746g-3gfp-hfhw

https://rubysec.com/advisories/CVE-2015-8314/

https://github.com/heartcombo/devise/commit/c92996646aba2d25b2c3e235fe0c4f1a84b70d24

Details

Source: Mitre, NVD

Published: 2023-12-12

Updated: 2025-05-27

Risk Information

CVSS v2

Base Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:N

Severity: High

CVSS v3

Base Score: 7.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N