CVE-2024-21654

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Rubygems.org is the Ruby community's gem hosting service. Rubygems.org users with MFA enabled would normally be protected from account takeover in the case of email account takeover. However, a workaround on the forgotten password form allows an attacker to bypass the MFA requirement and takeover the account. This vulnerability has been patched in commit 0b3272a.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287 CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-216554.3Discourse is a platform for community discussion. For fields that are client editable, limits on sizes are not imposed. This allows a malici CVE-2024-216584.3discourse-calendar is a discourse plugin which adds the ability to create a dynamic calendar in the first post of a topic. The limit on regi CVE-2024-21666.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Forcepoint Email Security (Real Time M CVE-2024-216617.5Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can explo CVE-2024-216629.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can effec CVE-2024-216638.8Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord CVE-2024-216647.5jwx is a Go module implementing various JWx (JWA/JWE/JWK/JWS/JWT, otherwise known as JOSE) technologies. Calling `jws.Parse` with a JSON ser CVE-2024-216654.3ecommerce-framework-bundle is the Pimcore Ecommerce Framework Bundle. An authenticated and unauthorized user can access the back-office orde CVE-2024-216666.5The Customer Management Framework (CMF) for Pimcore adds functionality for customer data management, segmentation, personalization and marke CVE-2024-216676.5pimcore/customer-data-framework is the Customer Management Framework for management of customer data within Pimcore. An authenticated and un CVE-2024-216684.9react-native-mmkv is a library that allows easy use of MMKV inside React Native applications. Before version 2.11.0, the react-native-mmkv l CVE-2024-216698.8Hyperledger Aries Cloud Agent Python (ACA-Py) is a foundation for building decentralized identity applications and services running in non-m