CVE catalog
CVE-2019-16109
UBUNTU-CVE-2019-16109
- Severity
- Unknown
- Published
- Updated
- Source
- [NVD] · [CVE record]
- EPSS
- 1.83% · Oct 25, 2026
An issue was discovered in Plataformatec Devise before 4.7.1. It confirms accounts upon receiving a request with a blank confirmation_token, if a database record has a blank value in the confirmation_token column. (However, there is no scenario within Devise itself in which such database records would exist.)
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Ubuntu | ruby-devise | 16.04 | 3.5.1-1 | vulnerable |
| Ubuntu | ruby-devise | 16.04 | 3.5.2-1 | vulnerable |
| Ubuntu | ruby-devise | 16.04 | 3.5.2-2 | vulnerable |
| Ubuntu | ruby-devise | 16.04 | 3.5.2-3 | vulnerable |
| Ubuntu | ruby-devise | 16.04 | 3.5.6-2 | vulnerable |
| Ubuntu | ruby-devise | 18.04 | 4.2.0-1 | vulnerable |
| Ubuntu | ruby-devise | 18.04 | 4.3.0-1 | vulnerable |
| Ubuntu | ruby-devise | 18.04 | 4.4.3-1 | vulnerable |
| Ubuntu | ruby-devise | 20.04 | 4.5.0-3 | vulnerable |
| Ubuntu | ruby-devise | 20.04 | 4.6.2-2 | vulnerable |
| Ubuntu | ruby-devise | 20.04 | 4.7.1-2 | vulnerable |
| Ubuntu | ruby-devise | 22.04 | 4.7.3-2 | vulnerable |
| Ubuntu | ruby-devise | 24.04 | 4.8.1-1 | vulnerable |
| Ubuntu | ruby-devise | 24.04 | 4.9.2-1 | vulnerable |
| Ubuntu | ruby-devise | 24.04 | 4.9.3-1 | vulnerable |
Fixed-version evidence
OpenFactory catalog packages
No matching packages in this catalog.
Observed: