Doorkeeper Improper Authentication vulnerability
CVE-2023-34246

4.2MEDIUM

Key Information:

Vendor

Doorkeeper-gem

Status
Doorkeeper
Vendor
CVE Published:
12 June 2023

What is CVE-2023-34246?

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.

Affected Version(s)

doorkeeper < 5.6.6

References

https://github.com/doorkeeper-gem/doorkeeper/security/adv...
x_refsource_CONFIRM
https://github.com/doorkeeper-gem/doorkeeper/issues/1589
x_refsource_MISC
https://github.com/doorkeeper-gem/doorkeeper/pull/1646
x_refsource_MISC

CVSS V3.1

Score:
4.2
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.