CVE-2020-10187
At a glance
- Source
- NVD
- EPSS
- EPSS 1.78 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- mitre
- NVD status
- Modified
Description
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
Weaknesses (CWE)
- CWE-862 — Missing Authorization
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-j7vx-8mqj-cqp9 — Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
European references
- ENISA EUVD · EUVD-2020-0426
- GCVE · GCVE-0-2020-10187
CERT-FR advisories
- CERTFR-2020-AVI-257 — Multiples vulnérabilités dans GitLab · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.0.0 < 5.0.3cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.1.0 < 5.1.1cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.2.0 < 5.2.5cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.3.0 < 5.3.2
Affected products
| Product | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |