Doorkeeper
Approved changes feed: RSS · Atom
cpe:2.3:a:doorkeeper_project:doorkeeper:*:*:*:*:*:ruby:*:*
part: a version: * update: *
| Vendor | Doorkeeper Project (e389fb85-e877-5ffe-8553-c8fce75bc67a) |
|---|---|
| Product | Doorkeeper (05023f2f-edd1-5078-8c7c-7542d46c8f48) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | ruby |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-34246 |
vulnerable | 2026-06-08 06:06:24.937237 |
Doorkeeper Improper Authentication vulnerability
MEDIUM (4.2)
Doorkeeper is an OAuth 2 provider for Ruby on Rails / Grape. Prior to version 5.6.6, Doorkeeper automatically processes authorization requests without user consent for public clients that have been previous approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured. This issue is fixed in version 5.6.6.
Published: 2023-06-12T16:33:05.704Z
Updated: 2025-02-13T16:55:25.344Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-10187 |
vulnerable | 2026-06-08 05:16:34.575956 |
Details available
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability that allows an attacker to retrieve the client secret only intended for the OAuth application owner. After authorizing the application and allowing access, the attacker simply needs to request the list of their authorized applications in a JSON format (usually GET /oauth/authorized_applications.json). An application is vulnerable if the authorized applications controller is enabled.
Published: 2020-05-04T13:19:04.000Z
Updated: 2024-08-04T10:58:39.628Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-1000088 |
vulnerable | 2026-06-08 05:10:25.410701 |
Details available
Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.
Published: 2018-03-13T15:00:00.000Z
Updated: 2024-08-05T12:33:49.282Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2016-6582 |
vulnerable | 2026-06-08 05:08:02.832077 |
Details available
The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.
Published: 2017-01-23T21:00:00.000Z
Updated: 2024-08-06T01:36:28.287Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2014-8144 |
vulnerable | 2026-06-08 05:06:08.122139 |
Details available
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.
Published: 2014-12-31T22:00:00.000Z
Updated: 2024-08-06T13:10:50.952Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.