CVE Vulnerability

CVE-2018-1000088

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.

4.3 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

6.1 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://github.com/rubysec/ruby-advisory-db/pull/328/files Third Party Advisory
https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0 Release Notes
https://github.com/doorkeeper-gem/doorkeeper/pull/970 Issue Tracking
https://github.com/doorkeeper-gem/doorkeeper/issues/969 Issue Tracking
Configurations

Configuration 1

cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*
Information

Published : 2018-03-13 03:29

Updated : 2018-04-11 01:48

NVD link : CVE-2018-1000088

Mitre link : CVE-2018-1000088

Products Affected
No products.
CWE
CWE-79