Insufficient Token Expiration Affecting doorkeeper package, versions >=4.2.0, <4.4.0 =5.0.0.rc1
Threat Intelligence
EPSS
0.15% (53rd
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-DOORKEEPER-22044
- published 19 Jul 2018
- disclosed 13 Jul 2018
- credit Roberto Ostinelli
Introduced: 13 Jul 2018
CVE-2018-1000211 Open this link in a new tabHow to fix?
Upgrade to version 4.4.0, 5.0.0.rc2 or higher
Overview
doorkeeper is an OAuth 2 provider for Rails and Grape.
Affected versions of this package are vulnerable to Insufficient Token Expiration. All OAuth applications using public or non-confidential authentication when interacting with Doorkeeper would attempt to authenticate the public OAuth client as if it were a confidential app. This would cause the token to not be revoked from the endpoint, and the token could be used for the remainder of that token's lifetime.
References
CVSS Scores
version 3.1