CVE-2023-34246
Doorkeeper Improper Authentication vulnerability
Summary
Doorkeeper Improper Authentication vulnerability
Original description
The description as published by the source.
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-34246 ruby-doorkeeper Fixed in: 5.3.0-2+deb11u1
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- report github.com
- web github.com
- web lists.debian.org
- web lists.debian.org
- web rfc-editor.org