Lucene search

GitHub_MCVELIST:CVE-2023-34246

HistoryJun 12, 2023 - 4:33 p.m.

CVE-2023-34246 Doorkeeper Improper Authentication vulnerability

2023-06-1216:33:05

CWE-287

GitHub_M

raw.githubusercontent.com

doorkeeper

oauth 2

ruby on rails

grape

improper authentication

vulnerability

public clients

impersonation

identity

authorization requests

6.1 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

29.9%

JSON

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.