Doorkeeper is vulnerable to replay attacks

Description

References

• nvd.nist.gov/vuln/detail/CVE-2016-6582 · ADVISORY
• doorkeeper-gem/doorkeeper · WEB
• GitHub Advisory GHSA-3m6r-39p3-jq25 · ADVISORY
• doorkeeper-gem/doorkeeper · WEB
• doorkeeper-gem/doorkeeper release v4.2.0 · WEB
• rubysec/ruby-advisory-db · WEB
• web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551 · WEB
• web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded · WEB
• packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html · WEB
• seclists.org/fulldisclosure/2016/Aug/105 · WEB
• openwall.com/lists/oss-security/2016/08/19/2

Autres vulnérabilités de doorkeeper

• CVE-2023-34246MOYENNE 6.5Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization reques…
• CVE-2020-10187ÉLEVÉE 7.5Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret on…
• CVE-2018-1000211ÉLEVÉE 7.5Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can re…
• CVE-2018-1000088MOYENNE 6.1Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization …
• CVE-2014-8144MOYENNE 6.8Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecifi…