vulnwire
7.5high

CVE-2020-10187

Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

Also known as GHSA-j7vx-8mqj-cqp9

Published 6 y ago · modified 1 mo ago · JSON

CVSS
7.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known

Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.

Exploit prediction (EPSS)

1.78% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD2.04.3AV:N/AC:M/Au:N/C:P/I:N/A:N
GitHub3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected packages

EcosystemPackageAffectedFixed in
rubygemsdoorkeeper
>=5.0.0, <5.0.3
>=5.1.0, <5.1.1
>=5.2.0, <5.2.5
>=5.3.0, <5.3.2
5.0.3
5.1.1
5.2.5
5.3.2

Classification

Weakness

References

  • github.com /doorkeeper-gem/doorkeeper/releases · x_refsource_MISC, x_transferred
  • github.com /doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6 · x_refsource_MISC, x_transferred
  • github.com /doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9 · x_refsource_MISC, x_transferred
  • github.com /rubysec/ruby-advisory-db/pull/446 · x_refsource_MISC, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2020-10187 · advisory
  • github.com /rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2020-10187.yml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.