GitHub Advisoryadvisory · PyPI

GHSA-g86p-hgx5-2pfh Improper Authentication in Buildbot

CRITICAL Published 2019-05-29 Modified 2024-09-13 Official page ↗
Aliases
CVE-2019-12300
Ecosystem
PyPI
Packages
buildbot
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-287
Reviewed
2019-05-29

Affected packages

• PyPI buildbot: < 1.8.2 → fixed in 1.8.2 • PyPI buildbot: >= 2.0.0, < 2.3.1 → fixed in 2.3.1

Description

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.

Related

Alias · CVE (1)

  • CVE-2019-12300 Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. vulnerability

Weakness · CWE (1)

  • CWE-287 Improper Authentication weakness

References