Doorkeeper vulnerable to Cross-site Request Forgery

Description

References

• nvd.nist.gov/vuln/detail/CVE-2014-8144 · ADVISORY
• exchange.xforce.ibmcloud.com/vulnerabilities/99342 · WEB
• doorkeeper-gem/doorkeeper · PACKAGE
• doorkeeper-gem/doorkeeper · WEB
• seclists.org/oss-sec/2014/q4/1076 · WEB

Autres vulnérabilités de doorkeeper

• CVE-2023-34246MOYENNE 6.5Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization reques…
• CVE-2020-10187ÉLEVÉE 7.5Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret on…
• CVE-2018-1000211ÉLEVÉE 7.5Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can re…
• CVE-2018-1000088MOYENNE 6.1Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization …
• CVE-2016-6582CRITIQUE 9.1The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging fai…