Published: 07/02/2020 Updated: 11/02/2020

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

The omniauth-weibo-oauth2 gem 0.4.6 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Versions up to and including 0.4.5, and 0.5.1 and later, are unaffected.

Vulnerable Product	Search on Vulmon	Subscribe to Product
omniauth-weibo-oauth2 project omniauth-weibo-oauth2 0.4.6

OmniAuth Oauth2 strategy for weibo.com.

Status OmniAuth Weibo OAuth2 Weibo OAuth2 Strategy for OmniAuth 10 Read Weibo OAuth2 docs for more details: openweibocom/wiki/授权机制 Security CVE-2019-17268 Issue #36 Installing Add to your Gemfile: gem 'omniauth-weibo-oauth2' Then bundle install Or install it yourself as: $ gem install omniauth-weibo-oa

CWE-94 https://diff.coditsu.io/diffs/09a05c37-1b34-49e1-ac94-d4dda40d1ad1#d2h-971595 https://github.com/beenhero/omniauth-weibo-oauth2/issues/36 https://nvd.nist.gov https://github.com/beenhero/omniauth-weibo-oauth2

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-17268

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect