7.5

CVE-2020-10187

Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Doorkeeper Project ≫ Doorkeeper SwPlatformruby Version >= 5.0.0 < 5.0.3
Doorkeeper Project ≫ Doorkeeper SwPlatformruby Version >= 5.1.0 < 5.1.1
Doorkeeper Project ≫ Doorkeeper SwPlatformruby Version >= 5.2.0 < 5.2.5
Doorkeeper Project ≫ Doorkeeper SwPlatformruby Version >= 5.3.0 < 5.3.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.02% 0.784
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
Patch
Third Party Advisory
https://github.com/doorkeeper-gem/doorkeeper/releases
Third Party Advisory
Release Notes
https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
Patch
Third Party Advisory
https://github.com/rubysec/ruby-advisory-db/pull/446
Patch
Third Party Advisory