CVE-2015-8314
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
CVE-2015-8314 is a high vulnerability (CVSS 7.5) in Heartcombo Devise, published January 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. Fixed in devise 3.5.4.
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Record
CVE-2015-8314- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
CVE List
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Record
CVE-2015-8314- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-312
- Updated
- 2026-11-02
EUVDEUVD-2023-0374
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Record
EUVD-2023-0374- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-746g-3gfp-hfhw
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
- Record
GHSA-746g-3gfp-hfhw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288, CWE-312
- Updated
- 2026-11-02
OSV
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Record
CVE-2015-8314- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2015-8314
The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access.
- Record
DEBIAN-CVE-2015-8314- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-746g-3gfp-hfhw
Devise Gem for Ruby Unauthorized Access Using "Remember Me" Cookie
Devise version before 3.5.4 uses cookies to implement a "Remember me" functionality. However, it generates the same cookie for all devices. If an attacker manages to steal a remember me cookie and the user does not change the password frequently, the cookie can be used to gain access to the application indefinitely.
- Record
GHSA-746g-3gfp-hfhw- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-288, CWE-312
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
deviseRubyGems |
before 3.5.4 | 3.5.4 |
ruby-deviseDebian:12 |
before 3.5.6-2 | 3.5.6-2 |
deviseRubyGems |
before 3.5.4, plus listed versions 0.1.00.1.10.2.00.2.10.2.2 Show 45 moreShow less0.2.30.3.00.4.00.4.10.4.20.4.30.5.00.5.10.5.20.5.30.5.40.5.50.5.60.6.00.6.10.6.20.6.30.7.00.7.10.7.20.7.30.7.40.7.50.8.00.8.10.8.20.9.00.9.10.9.21.0.01.0.11.0.101.0.111.0.21.0.31.0.41.0.51.0.61.0.71.0.81.0.91.1.01.1.11.1.21.1.3 |
3.5.4 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, GitHub Advisories, NVD, OSV |
References
rubysec.com/advisories/CVE-2015-8314
github.com/advisories/GHSA-746g-3gfp-hfhw
blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise
nvd.nist.gov/vuln/detail/CVE-2015-8314
security-tracker.debian.org/tracker/CVE-2015-8314
Left out here: 80 versions. The JSON record has them.