vulnwire
9.1crit

CVE-2016-6582

Doorkeeper is vulnerable to replay attacks

Also known as GHSA-3m6r-39p3-jq25

Published 9 y ago · modified 4 mo ago · JSON

CVSS
9.1
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.8%
percentile 92%
Public exploits
0
none known

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

Exploit prediction (EPSS)

4.81% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
NVD2.06.4AV:N/AC:L/Au:N/C:N/I:P/A:P
GitHub3.09.1CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
rubygemsdoorkeeper
<4.2.0
4.2.0

Classification

Weakness
  • CWE-254 7PK - Security Features
  • CWE-1254 Incorrect Comparison Logic Granularity

References

  • securityfocus.com /bid/92551 · vdb-entry, x_refsource_BID, x_transferred
  • packetstormsecurity.com /files/138430/Doorkeeper-4.1.0-Token-Revocation.html · x_refsource_MISC, x_transferred
  • securityfocus.com /archive/1/539268/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • seclists.org /fulldisclosure/2016/Aug/105 · mailing-list, x_refsource_FULLDISC, x_transferred
  • github.com /doorkeeper-gem/doorkeeper/releases/tag/v4.2.0 · x_refsource_CONFIRM, x_transferred
  • github.com /doorkeeper-gem/doorkeeper/issues/875 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2016-6582 · advisory
  • github.com /advisories/GHSA-3m6r-39p3-jq25 · advisory
  • github.com /doorkeeper-gem/doorkeeper · web
  • github.com /rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml · web
  • web.archive.org /web/20170214021758/http://www.securityfocus.com/bid/92551 · web
  • web.archive.org /web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded · web
  • openwall.com /lists/oss-security/2016/08/19/2 · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.