Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

🗓️ 07 May 2020 21:11:07Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 100 Views

Exposure of Sensitive Information to Unauthorized Actor in Doorkeeper. Information disclosure vulnerability patched in versions 5.0.3, 5.1.1, 5.2.5, 5.3.2. Recommends patching #as_json method and enabling application secrets hashing for added security

Reporter	Title	Published	Views	Family All 17
CNVD	Doorkeeper Information Disclosure Vulnerability	6 May 202000:00	–	cnvd
CVE	CVE-2020-10187	4 May 202013:19	–	cve
Cvelist	CVE-2020-10187	4 May 202013:19	–	cvelist
Debian CVE	CVE-2020-10187	4 May 202013:19	–	debiancve
FreeBSD	Gitlab -- Multiple Vulnerabilities	30 Apr 202000:00	–	freebsd
EUVD	EUVD-2020-0426	7 Oct 202500:30	–	euvd
Tenable Nessus	FreeBSD : Gitlab -- Multiple Vulnerabilities (e8483115-8b8e-11ea-bdcf-001b217b3468)	4 May 202000:00	–	nessus
NVD	CVE-2020-10187	4 May 202014:15	–	nvd
OSV	DEBIAN-CVE-2020-10187	4 May 202014:15	–	osv
OSV	GHSA-J7VX-8MQJ-CQP9 Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper	7 May 202021:11	–	osv

Vulners

Node

doorkeeper_project doorkeeperRange5.3.0–5.3.2rubygems

doorkeeper_project doorkeeperRange5.2.0–5.2.5rubygems

doorkeeper_project doorkeeperMatch5.1.0rubygems

doorkeeper_project doorkeeperRange5.0.0–5.0.3rubygems

Source	Link
github	www.github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-10187
github	www.github.com/rubysec/ruby-advisory-db/pull/446
github	www.github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
github	www.github.com/doorkeeper-gem/doorkeeper/releases
github	www.github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2020-10187.yml
github	www.github.com/advisories/GHSA-j7vx-8mqj-cqp9

04 May 2023 19:47Current

0.2Low risk

Vulners AI Score0.2

CVSS 24.3

CVSS 3.17.5

EPSS0.00425

CWE-862