netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-2qgm-m29m-cj2h
GHSA-3q97-vjpp-c8rp
This commit is contained in:
advisory-database[bot]
2024-12-20 18:02:06 +00:00
parent 8db1381ad4
commit d2c4246c51
2 changed files with 8 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2024/12/GHSA-2qgm-m29m-cj2h/GHSA-2qgm-m29m-cj2h.json
+4 -2
View File
File diff suppressed because one or more lines are too long
advisories/github-reviewed/2024/12/GHSA-3q97-vjpp-c8rp/GHSA-3q97-vjpp-c8rp.json
+4 -2
View File
@@ -1,9 +1,11 @@
{
"schema_version": "1.4.0",
"id": "GHSA-3q97-vjpp-c8rp",
"modified": "2024-12-20T15:01:20Z",
"modified": "2024-12-20T18:00:18Z",
"published": "2024-12-20T15:01:20Z",
"aliases": [],
"aliases": [
"CVE-2024-56329"
],
"summary": "Socialstream has a Potential Account Takeover Vulnerability in Social Account Linking Due to Missing User Consent After OAuth Callback",
"details": "## Description\n\nWhen linking a social account to an already authenticated user, the lack of a confirmation step introduces a security risk. This is exacerbated if ->stateless() is used in the Socialite configuration, bypassing state verification and making the exploit easier. Developers should ensure that users explicitly confirm account linking and avoid configurations that skip critical security checks.\n\n## Resolution\nSocialstream v6.2 introduces a new custom route that requires a user to \"Confirm\" or \"Deny\" a request to link a social account.",
"severity": [