CVE-2019-16109
CVE-2019-16109
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
CVSS 5.3 · Medium · EPSS 1.8%
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
ruby-devise Ubuntu:16.04:LTS
- Versions
- 3.5.1-1
- 3.5.2-1
- 3.5.2-2
- 3.5.2-3
- 3.5.6-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-devise Ubuntu:18.04:LTS
- Versions
- 4.2.0-1
- 4.3.0-1
- 4.4.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-devise Ubuntu:20.04:LTS
- Versions
- 4.5.0-3
- 4.6.2-2
- 4.7.1-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-devise Ubuntu:22.04:LTS
- Versions
- 4.7.3-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
ruby-devise Ubuntu:24.04:LTS
- Versions
- 4.8.1-1
- 4.9.2-1
- 4.9.3-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published