CVE-2021-46249

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6…

Medium · published February 15, 2022

CVSS v3.1
6.5
EPSS
1%
Percentile
50.2
In the wild
Unconfirmed
What it is

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AC:L/AV:N/A:N/C:N/I:H/PR:L/S:U/UI:N
CVSS v4.0
Not supplied
EPSS
0.00643 · 50.2th percentile
Published
2022-02-15T22:13Z
EPSS history
Timeline
  • 15 FEB 22:13Z
    An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6…
    cvelistv5