VulnerabilityModified

CVE-2016-6582

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

CRITICAL 9.1EPSS 4.72%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (4.72%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

CVSS 3.0: 9.1 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS: 4.72% probability · 91th percentile
CISA KEV: Not listed
Weakness: CWE-254
Affected: doorkeeper project/doorkeeper
Source: cve@mitre.org

References

http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Aug/105Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/archive/1/539268/100/0/threaded
http://www.securityfocus.com/bid/92551Third Party Advisory, VDB Entry
https://github.com/doorkeeper-gem/doorkeeper/issues/875Issue Tracking, Patch, Third Party Advisory
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0Issue Tracking, Patch, Release Notes, Third Party Advisory
http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2016/Aug/105Mailing List, Patch, Third Party Advisory
http://www.securityfocus.com/archive/1/539268/100/0/threaded
http://www.securityfocus.com/bid/92551Third Party Advisory, VDB Entry
https://github.com/doorkeeper-gem/doorkeeper/issues/875Issue Tracking, Patch, Third Party Advisory
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0Issue Tracking, Patch, Release Notes, Third Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.