Published: 23/05/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Buildbot prior to 1.8.2 and 2.x prior to 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.

Vulnerable Product	Search on Vulmon	Subscribe to Product
buildbot buildbot

Debian Bug report logs - #929849 buildbot: CVE-2019-12300: OAuth vulnerability in using submitted authorization token for authentication Package: src:buildbot; Maintainer for src:buildbot is Python Applications Packaging Team <python-apps-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg&g ...

CWE-287 https://github.com/buildbot/buildbot/wiki/OAuth-vulnerability-in-using-submitted-authorization-token-for-authentication https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4XLOM2K4M4723BCLHZJEX52KJXZSEVRL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7GXKO7OYLKBTXXXKF4VPHWT7GVYWFVYA/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=929849 https://nvd.nist.gov

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-12300

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect