GHSA-694m-jhr9-pf77

ghsaUSosv

Doorkeeper subject to Incorrect Permission Assignment

view advisory published 2018-08-13Licence: CC-BY-4.0

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2018-1000211US	high7.5	1.55% (75th)	—	2018-07-13
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked fo…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-694m-jhr9-pf77ADVISORY
https://github.com/doorkeeper-gem/doorkeeperPACKAGE
https://github.com/doorkeeper-gem/doorkeeper/issues/891WEB
https://github.com/doorkeeper-gem/doorkeeper/pull/1119WEB
https://nvd.nist.gov/vuln/detail/CVE-2018-1000211ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan