Candidate: CVE-2020-10187
PublicDate: 2020-05-04 14:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10187
 https://github.com/doorkeeper-gem/doorkeeper/commit/25d038022c2fcad45af5b73f9d003cf38ff491f6
 https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-j7vx-8mqj-cqp9
 https://github.com/doorkeeper-gem/doorkeeper/releases
 https://github.com/rubysec/ruby-advisory-db/pull/446
Description:
 Doorkeeper version 5.0.0 and later contains an information disclosure
 vulnerability that allows an attacker to retrieve the client secret only
 intended for the OAuth application owner. After authorizing the application
 and allowing access, the attacker simply needs to request the list of their
 authorized applications in a JSON format (usually GET
 /oauth/authorized_applications.json). An application is vulnerable if the
 authorized applications controller is enabled.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=959903
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N [7.5 HIGH]


Patches_ruby-doorkeeper:
upstream_ruby-doorkeeper: needs-triage
precise/esm_ruby-doorkeeper: DNE
trusty_ruby-doorkeeper: ignored (out of standard support)
trusty/esm_ruby-doorkeeper: DNE
xenial_ruby-doorkeeper: ignored (end of standard support, was needs-triage)
bionic_ruby-doorkeeper: needs-triage
eoan_ruby-doorkeeper: ignored (reached end-of-life)
focal_ruby-doorkeeper: needs-triage
groovy_ruby-doorkeeper: not-affected (5.0.3-1)
hirsute_ruby-doorkeeper: not-affected (5.0.3-1)
impish_ruby-doorkeeper: not-affected (5.0.3-1)
jammy_ruby-doorkeeper: not-affected (5.0.3-1)
devel_ruby-doorkeeper: not-affected (5.0.3-1)