CVE-2020-10187
En bref
- Source
- NVD
- EPSS
- EPSS 1.78 % · centile 78 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Rechercher sur…
Description
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
Faiblesses (CWE)
- CWE-862 — Autorisation absente
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-j7vx-8mqj-cqp9 — Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper
Références européennes
- ENISA EUVD · EUVD-2020-0426
- GCVE · GCVE-0-2020-10187
Avis du CERT-FR
- CERTFR-2020-AVI-257 — Multiples vulnérabilités dans GitLab · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.0.0 < 5.0.3cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.1.0 < 5.1.1cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.2.0 < 5.2.5cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*≥ 5.3.0 < 5.3.2
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |