Doorkeeper vulnerable to Cross-site Request Forgery

MEDIUM 6.8CVE-2014-8144 · GHSA-685w-vc84-wxcx · Published 31/12/2014 · updated 17/06/2026

In short

CVE-2014-8144 is a MEDIUM (CVSS 6.8) vulnerability affecting doorkeeper, doorkeeper (doorkeeper project).
Chance of exploitation in the next 30 days (EPSS): 0.65%, higher than 51.4% of all vulnerabilities.
Fix: update to 1.4.1 or later.

Package	Affected versions	Patched versions
doorkeeper RubyGems	`< 1.4.1`	`1.4.1`
doorkeeper doorkeeper_project	`≤ 1.4.0`	No fix yet

Description

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

NVD description

References

nvd.nist.gov/vuln/detail/CVE-2014-8144 · ADVISORY
exchange.xforce.ibmcloud.com/vulnerabilities/99342 · WEB
doorkeeper-gem/doorkeeper · PACKAGE
doorkeeper-gem/doorkeeper · WEB
seclists.org/oss-sec/2014/q4/1076 · WEB

More vulnerabilities in doorkeeper

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

doorkeeper

RubyGems

< 1.4.1

1.4.1

doorkeeper

doorkeeper_project

≤ 1.4.0

No fix yet

Description

NVD description

More vulnerabilities in doorkeeper

See all →