TI-2023-17082 CVE-2023-34246 · GHSA-7w2c-w47h-789w
Doorkeeper Improper Authentication vulnerability
Priority MEDIUM 64
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape.
Doorkeeper Project
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Doorkeeper Project records in CISA KEVNo Doorkeeper Project vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2016-05635 CVE-2016-6582 · GHSA-3m6r-39p3-jq25
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay…
Priority MEDIUM 47
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
TI-2020-08208 CVE-2020-10187 · GHSA-j7vx-8mqj-cqp9
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that…
Priority LOW 36
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner.
TI-2018-15860 CVE-2018-1000211 · GHSA-694m-jhr9-pf77
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in…
Priority LOW 36
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access unti…
TI-2014-06759 CVE-2014-8144 · GHSA-685w-vc84-wxcx
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote…
Priority LOW 31
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown ve…
TI-2018-15743 CVE-2018-1000088 · GHSA-hwhh-2fwm-cfgw
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS)…
Priority LOW 30
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will ca…