CVE-2023-34246CWE-287

Doorkeeper Improper Authentication vulnerability

Medium · published June 12, 2023

CVSS v3.1
4.2
EPSS
1%
Percentile
53.3
In the wild
Unconfirmed
What it is

Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.

The record
Technical detail
CVSS v3.1
4.2 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00716 · 53.3th percentile
Weakness
CWE-287 · Improper Authentication
Published
2023-06-12T16:33Z
EPSS history
Timeline
  • 12 JUN 16:33Z
    Doorkeeper Improper Authentication vulnerability
    cvelistv5