From 91d091ba185de60949407f93fff5853fcc403428 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 11 Jul 2023 20:20:52 +0000
Subject: [PATCH] Publish GHSA-7w2c-w47h-789w

---
 .../2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json b/advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json
index 72832f201b2..62e7243c091 100644
--- a/advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json
+++ b/advisories/github-reviewed/2023/06/GHSA-7w2c-w47h-789w/GHSA-7w2c-w47h-789w.json
@@ -1,13 +1,13 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-7w2c-w47h-789w",
-  "modified": "2023-06-12T19:50:34Z",
+  "modified": "2023-07-11T20:19:37Z",
   "published": "2023-06-12T19:50:34Z",
   "aliases": [
     "CVE-2023-34246"
   ],
   "summary": "Doorkeeper Improper Authentication vulnerability",
-  "details": "OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646",
+  "details": "OAuth RFC 8252 says  https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646",
   "severity": [
     {
       "type": "CVSS_V3",