VulnerabilityModified

CVE-2018-1000088

MEDIUM 6.1EPSS 1.43%

Does this matter?

Lower severity and a low EPSS score (1.43%). Track it; it rarely justifies an emergency change on its own.

Description

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.

CVSS 3.0: 6.1 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS: 1.43% probability · 73th percentile
Public exploits: None in Exploit-DB
CISA KEV: Not listed
Weakness: CWE-79
Affected: doorkeeper project/doorkeeper
Source: cve@mitre.org

EPSS trend

EPSS 1.4% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

References

https://github.com/doorkeeper-gem/doorkeeper/issues/969Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/pull/970Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0Release Notes
https://github.com/rubysec/ruby-advisory-db/pull/328/filesThird Party Advisory
https://github.com/doorkeeper-gem/doorkeeper/issues/969Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/pull/970Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0Release Notes
https://github.com/rubysec/ruby-advisory-db/pull/328/filesThird Party Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.