Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
doorkeeper project doorkeeper vulnerabilities and exploits
(subscribe to this query)
NA
CVE-2023-34246
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, thei...
Doorkeeper Project Doorkeeper
4.3
CVSSv2
CVE-2020-10187
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an malicious user to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to reque...
Doorkeeper Project Doorkeeper
5
CVSSv2
CVE-2018-1000211
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
Doorkeeper Project Doorkeeper
4.3
CVSSv2
CVE-2018-1000088
Doorkeeper version 2.1.0 up to and including 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will exe...
Doorkeeper Project Doorkeeper
6.4
CVSSv2
CVE-2016-6582
The Doorkeeper gem prior to 4.2.0 for Ruby might allow remote malicious users to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Doorkeeper Project Doorkeeper
6.8
CVSSv2
CVE-2014-8144
Cross-site request forgery (CSRF) vulnerability in doorkeeper prior to 1.4.1 allows remote malicious users to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
Doorkeeper Project Doorkeeper
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
NULL pointer dereference
CVE-2023-52689
CVE-2024-23803
client side
CVE-2023-52696
information disclosure
CVE-2024-35843
CVE-2024-27130
CVE-2023-52697
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started