Lucene search
+L

1 matches found

RubySec
RubySec
added 2018/02/21 12:00 a.m.46 views

Doorkeeper gem has stored XSS on authorization consent view

Stored XSS on the OAuth Client's name will cause users being prompted for consent via the "implicit" grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link...

6.1CVSS2.7AI score0.01568EPSS
SaveExploits0References1Affected Software1
Rows per page
Query Builder