Read the docs

ory

Records15All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high8CVSS 7.0–8.9

Exploited now

ory records in CISA KEV

No ory vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Fosite 4 records LOW Oathkeeper 4 records MEDIUM Hydra 3 records LOW Keto 1 record LOW Kratos 1 record LOW Polis 1 record LOW

Records

4 records in Fosite · all components

TI-2020-11995 CVE-2020-15223 · GHSA-7mqr-2v3q-v2wm

Ignored storage errors on token revokation in ORY Fosite

Priority LOW 38

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage.

CVSS 3.1HIGH 8.0 Network No auth User interaction EPSS 0.01588 Published 2020-09-24 Fixed in 0.34.0 CWE-755
TI-2020-11994 CVE-2020-15222 · GHSA-v3q9-2p3m-7g43

Replay of private_key_jwt possible in ORY Fosite

Priority LOW 37

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.31.0, when using "private_key_jwt" authentication the uniqueness of the `jti` value is not checked.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.00867 Published 2020-09-24 Fixed in 0.31.0 CWE-287
TI-2020-12006 CVE-2020-15234 · GHSA-grfp-q2mm-hfp6

Redirect URL matching ignores character casing

Priority LOW 29

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go.

CVSS 3.1MEDIUM 6.1 Network High privileges User interaction EPSS 0.00841 Published 2020-10-02 Fixed in 0.34.1 CWE-20
Open these records in search →