GitHub Advisoryadvisory · RubyGems

GHSA-5g66-628f-7cvj Omniauth::MicrosoftGraph Account takeover (nOAuth)

HIGH Published 2024-01-03 Modified 2024-01-03 Official page ↗
Aliases
CVE-2024-21632
Ecosystem
RubyGems
Packages
omniauth-microsoft_graph
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Weaknesses
CWE-287
Reviewed
2024-01-03

Affected packages

• RubyGems omniauth-microsoft_graph: < 2.0.0 → fixed in 2.0.0

Description

Summary The implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier

Related

Alias · CVE (1)

  • CVE-2024-21632 omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References