GitHub Advisoryadvisory · Go

GHSA-7mqr-2v3q-v2wm Ory fosite contains Improper Handling of Exceptional Conditions

HIGH Published 2021-05-24 Modified 2023-02-14 Official page ↗
Aliases
CVE-2020-15223
Ecosystem
Go
Packages
github.com/ory/fosite
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Weaknesses
CWE-754, CWE-755
Reviewed
2021-05-24

Affected packages

• Go github.com/ory/fosite: < 0.34.0 → fixed in 0.34.0

Description

Impact The `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. References RFC 7009 states that a 503 HTTP code must be returned when the server has a problem.

Related

Alias · CVE (1)

  • CVE-2020-15223 In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores… vulnerability

Weakness · CWE (2)

  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

References