CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

CVE-2024-21632 omniauth-microsoft_graph vulnerable to account takeover (nOAuth)

omniauth-microsoftgraph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the email attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases...

Omniauth::MicrosoftGraph License Issues Vulnerability

Omniauth::MicrosoftGraph is an Omniauth policy for the Microsoft Graph Api from the individual developer Peter Philips. An authorization issue vulnerability exists in versions of Omniauth::MicrosoftGraph prior to 2.0.0, which stems from a failure to validate the legitimacy of a user's email...

Use Of Hard-coded Credentials

gitLab is vulnerable to Use of Hard-coded Credentials. This vulnerability exists because of hardcoded passwords being set for accounts registered through omniauth in gitLab, resulting in an authentication issue...

SUSE CVE-2012-6134

Cross-site request forgery CSRF vulnerability in the omniauth-oauth2 gem 1.1.1 and earlier for Ruby allows remote attackers to hijack the authentication of users for requests that modify session state...

SUSE CVE-2013-4562

The omniauth-facebook gem 1.4.1 before 1.5.0 does not properly store the session parameter, which allows remote attackers to conduct cross-site request forgery CSRF attacks via the state parameter...

SUSE CVE-2015-9284

The request phase of the OmniAuth Ruby gem 1.9.1 and earlier is vulnerable to Cross-Site Request Forgery when used as part of the Ruby on Rails framework, allowing accounts to be connected without user intent, user interaction, or feedback to the user. This permits a secondary account to be able ...

SUSE CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

Improper Authentication

Overview omniauth is a generalized Rack framework for multiple-provider authentication. Affected versions of this package are vulnerable to Improper Authentication. It does not escape the messagekey value. Remediation Upgrade omniauth to version 1.9.2 or higher. References - GitHub Commit...

Path Traversal

omniauth is vulnerable to path traversal. The vulnerability exists because the redirecttofailure function of failureendpoint.rb does not properly prefix the path in the messagekey attribute, allowing an attacker to access files outside the expected directory through the endpoint failure...

OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

GHSA-PM55-QFXR-H247 OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

OmniAuth's `lib/omniauth/failure_endpoint.rb` does not escape `message_key` value

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

DEBIAN-CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

Design/Logic Flaw

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

UBUNTU-CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

CVE-2020-36599

lib/omniauth/failureendpoint.rb in OmniAuth before 1.9.2 and before 2.0 does not escape the messagekey value...

CVE-2020-36599

Summary: CVE-2020-36599 affects the Ruby library OmniAuth, specifically lib/omniauth/failure_endpoint.rb. The issue occurs in OmniAuth before 1.9.2 and before 2.0 where the message_key value is not escaped, as described in the initial description and corroborated by references pointing to 1.9.2 r...