9.1

CVE-2016-6582

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Doorkeeper Project ≫ Doorkeeper SwPlatformruby Version <= 4.1.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.69% 0.906
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:N/I:P/A:P
Es wurden noch keine Informationen zu CWE veröffentlicht.
http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html
Third Party Advisory
VDB Entry
http://seclists.org/fulldisclosure/2016/Aug/105
Patch
Third Party Advisory
Mailing List
http://www.securityfocus.com/archive/1/539268/100/0/threaded
http://www.securityfocus.com/bid/92551
Third Party Advisory
VDB Entry
https://github.com/doorkeeper-gem/doorkeeper/issues/875
Patch
Third Party Advisory
Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0
Patch
Third Party Advisory
Release Notes
Issue Tracking