GitHub Advisoryadvisory · RubyGems

GHSA-685w-vc84-wxcx Doorkeeper vulnerable to Cross-site Request Forgery

MEDIUM Published 2018-09-17 Modified 2025-04-14 Official page ↗
Aliases
CVE-2014-8144
Ecosystem
RubyGems
Packages
doorkeeper
Severity
Moderate
Weaknesses
CWE-352
Reviewed
2020-06-16

Affected packages

• RubyGems doorkeeper: < 1.4.1 → fixed in 1.4.1

Description

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

Related

Alias · CVE (1)

  • CVE-2014-8144 Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References