GHSA-685w-vc84-wxcx

ghsaUSosv

Doorkeeper vulnerable to Cross-site Request Forgery

view advisory published 2018-09-17Licence: CC-BY-4.0

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2014-8144US	medium6.8	0.65% (51st)	—	2014-12-31
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user…

references

External citations — patches, advisories, analysis.

http://seclists.org/oss-sec/2014/q4/1076WEB
https://exchange.xforce.ibmcloud.com/vulnerabilities/99342WEB
https://github.com/doorkeeper-gem/doorkeeperPACKAGE
https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.mdWEB
https://nvd.nist.gov/vuln/detail/CVE-2014-8144ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan