CVE-2020-15223
Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.59%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
- CVSS 3.1
- 8.0 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- EPSS
- 1.59% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-755, CWE-754
- Affected
- ory/fosite
- Source
- security-advisories@github.com
References
- https://github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319Patch, Third Party Advisory
- https://github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wmThird Party Advisory
- https://tools.ietf.org/html/rfc7009#section-2.2.1Third Party Advisory
- https://github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319Patch, Third Party Advisory
- https://github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wmThird Party Advisory
- https://tools.ietf.org/html/rfc7009#section-2.2.1Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.