Vulnerability Description
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Doorkeeper Project | Doorkeeper | < 5.6.6 |
Related Weaknesses (CWE)
References
- https://github.com/doorkeeper-gem/doorkeeper/issues/1589ExploitIssue Tracking
- https://github.com/doorkeeper-gem/doorkeeper/pull/1646Patch
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6Release Notes
- https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html
- https://www.rfc-editor.org/rfc/rfc8252#section-8.6Technical Description
- https://github.com/doorkeeper-gem/doorkeeper/issues/1589ExploitIssue Tracking
- https://github.com/doorkeeper-gem/doorkeeper/pull/1646Patch
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6Release Notes
- https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html
- https://www.rfc-editor.org/rfc/rfc8252#section-8.6Technical Description
FAQ
What is CVE-2023-34246?
CVE-2023-34246 is a vulnerability with a CVSS score of 4.2 (MEDIUM). Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been pr...
How severe is CVE-2023-34246?
CVE-2023-34246 has been rated MEDIUM with a CVSS base score of 4.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-34246?
Check the references section above for vendor advisories and patch information. Affected products include: Doorkeeper Project Doorkeeper.