CVE-2023-34246
Doorkeeper Improper Authentication vulnerability
Vexday Risk Score
13Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 4.2EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch —
Ciclo de vida
12 jun 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Productos afectados
doorkeeper-gem · doorkeeper¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →Referencias
https://github.com/doorkeeper-gem/doorkeeper/issues/1589https://github.com/doorkeeper-gem/doorkeeper/pull/1646https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789whttps://lists.debian.org/debian-lts-announce/2023/07/msg00016.htmlhttps://lists.debian.org/debian-lts-announce/2024/12/msg00010.htmlhttps://www.rfc-editor.org/rfc/rfc8252#section-8.6