Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

doorkeeper

6 known vulnerabilities (1 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 1 medium
Registry
RubyGems

Advisories 6

  • CVE-2023-34246Medium 4.2

    Doorkeeper Improper Authentication vulnerability

    Affected: fixed in 5.6.6.

  • Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret…

    Affected: from 5.0.0, fixed in 5.0.3; from 5.1.0, fixed in 5.1.1; from 5.2.0, fixed in 5.2.5; from 5.3.0, fixed in 5.3.2.

  • Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can…

    Affected: from 4.2.0, fixed in 4.4.0.

  • Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user…

    Affected: from 2.1.0, fixed in 4.2.6.

  • The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging…

    Affected: fixed in 4.2.0.

  • Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of…

    Affected: fixed in 1.4.1.