RSS   Podatności dla 'Doorkeeper'   RSS

2020-05-04
 
CVE-2020-10187

CWE-200
 
 
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

 
2018-07-13
 
CVE-2018-1000211

CWE-732
 
 
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

 
2017-01-23
 
CVE-2016-6582

CWE-254
 
 
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

 
2014-12-31
 
CVE-2014-8144

 
 
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

 

Copyright 2024, cxsecurity.com

 

Back to Top