CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS
Percentile
55.9%
OAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6
> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. This includes the case where the user has previously approved an authorization request for a given client id
But Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.
Issue https://github.com/doorkeeper-gem/doorkeeper/issues/1589
Vendor | Product | Version | CPE |
---|---|---|---|
doorkeeper_project | doorkeeper | * | cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:*:*:* |
github.com/advisories/GHSA-7w2c-w47h-789w
github.com/doorkeeper-gem/doorkeeper/issues/1589
github.com/doorkeeper-gem/doorkeeper/pull/1646
github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6
github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w
github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml
lists.debian.org/debian-lts-announce/2023/07/msg00016.html
nvd.nist.gov/vuln/detail/CVE-2023-34246
www.rfc-editor.org/rfc/rfc8252#section-8.6