CVEvulnerability
CVE-2016-6582
9.1 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-01-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.1 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.4 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:P
- Weaknesses
- CWE-254
Description
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Affected configurations
• doorkeeper project doorkeeper (<= 4.1.0)
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Aug/105 Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/archive/1/539268/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/92551 Third Party Advisory, VDB Entry
- https://github.com/doorkeeper-gem/doorkeeper/issues/875 Issue Tracking, Patch, Third Party Advisory
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0 Issue Tracking, Patch, Release Notes, Third Party Advisory
- http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html Third Party Advisory, VDB Entry
- http://seclists.org/fulldisclosure/2016/Aug/105 Mailing List, Patch, Third Party Advisory
- http://www.securityfocus.com/archive/1/539268/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/92551 Third Party Advisory, VDB Entry
- https://github.com/doorkeeper-gem/doorkeeper/issues/875 Issue Tracking, Patch, Third Party Advisory
- https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0 Issue Tracking, Patch, Release Notes, Third Party Advisory