https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 00:16:16 +0000 https://vulnerability.circl.lu/vuln/cve-2021-28680 <p>The devise_masquerade gem before 1.3 allows certain attacks when a password&#39;s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the &#34;back&#34; action will go back to without knowing that user&#39;s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.</p> <p>The devise_masquerade gem before 1.3 allows certain attacks when a password&#39;s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side secret_key_base value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When devise_masquerade is used, however, an attacker can decide which user the &#34;back&#34; action will go back to without knowing that user&#39;s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.</p> https://vulnerability.circl.lu/vuln/cve-2021-28680 https://vulnerability.circl.lu/vuln/ghsa-25f5-gc4h-hc22 <p><strong>Affected:</strong> RubyGems: devise_masquerade</p> <p>The devise_masquerade gem before 1.3 allows certain attacks when a password&#39;s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the &#34;back&#34; action will go back to without knowing that user&#39;s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.</p> <p><strong>Affected:</strong> RubyGems: devise_masquerade</p> <p>The devise_masquerade gem before 1.3 allows certain attacks when a password&#39;s salt is unknown. An application that uses this gem to let administrators masquerade/impersonate users loses one layer of security protection compared to a situation where Devise (without this extension) is used. If the server-side `secret_key_base` value became publicly known (for instance if it is committed to a public repository by mistake), there are still other protections in place that prevent an attacker from impersonating any user on the site. When masquerading is not used in a plain Devise application, one must know the password salt of the target user if one wants to encrypt and sign a valid session cookie. When `devise_masquerade` is used, however, an attacker can decide which user the &#34;back&#34; action will go back to without knowing that user&#39;s password salt and simply knowing the user ID, by manipulating the session cookie and pretending that a user is already masqueraded by an administrator.</p> https://vulnerability.circl.lu/vuln/ghsa-25f5-gc4h-hc22