Detections
Analytics

SCA: security update for devise_masquerade (GHSA-25f5-gc4h-hc22)

high Tenable Cloud Security Plugin ID 408699

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - The devise_masquerade gem before 1.3 allows certain attacks when a password's salt is unknown. An
 application that uses this gem to let administrators masquerade/impersonate users loses one layer of
 security protection compared to a situation where Devise (without this extension) is used. If the server-
 side secret_key_base value became publicly known (for instance if it is committed to a public repository
 by mistake), there are still other protections in place that prevent an attacker from impersonating any
 user on the site. When masquerading is not used in a plain Devise application, one must know the password
 salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is
 used, however, an attacker can decide which user the "back" action will go back to without knowing that
 user's password salt and simply knowing the user ID, by manipulating the session cookie and pretending
 that a user is already masqueraded by an administrator. (CVE-2021-28680)

See Also

https://github.com/advisories/GHSA-25f5-gc4h-hc22

Plugin Details

Severity: High

ID: 408699

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 1/23/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2021-28680

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 12/8/2021

Vulnerability Publication Date: 12/7/2021

Reference Information

CVE: CVE-2021-28680

cwe: CWE-269