netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish GHSA-7w2c-w47h-789w

Browse Source
This commit is contained in:
advisory-database[bot]
2023-07-11 20:20:52 +00:00
parent 20107a970b
commit 91d091ba18
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json
+2 -2
View File
@@ -1,13 +1,13 @@
{
"schema_version": "1.4.0",
"id": "GHSA-7w2c-w47h-789w",
"modified": "2023-06-12T19:50:34Z",
"modified": "2023-07-11T20:19:37Z",
"published": "2023-06-12T19:50:34Z",
"aliases": [
"CVE-2023-34246"
],
"summary": "Doorkeeper Improper Authentication vulnerability",
"details": "OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646",
"details": "OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646",
"severity": [
{
"type": "CVSS_V3",