GHSA-694m-jhr9-pf77

Doorkeeper subject to Incorrect Permission Assignment

Source: GitHub Advisory Database (reviewed) High CVE-2018-1000211

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	doorkeeper	>= 4.2.0, < 4.4.0	4.4.0

Details

As written in the advisory (Markdown source, shown as plain text).

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1000211 advisory
https://github.com/doorkeeper-gem/doorkeeper/issues/891 web
https://github.com/doorkeeper-gem/doorkeeper/pull/1119 web
https://github.com/advisories/GHSA-694m-jhr9-pf77 advisory
https://github.com/doorkeeper-gem/doorkeeper package