Medium CVE-2014-8144 EUVD-2018-0441GHSA-685w-vc84-wxcx

Doorkeeper vulnerable to Cross-site Request Forgery

Published Dec 31, 2014 · Updated Aug 6, 2024 · Assigned by redhat

Description

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	doorkeeper	< 1.4.1	1.4.1	GHSA-685w-vc84-wxcx

References

https://github.com/doorkeeper-gem/doorkeeper/blob/master/CHANGELOG.md
doorkeeper-cve20148144-csrf(99342) vdb-entry
[oss-security] 20141217 [CVE-2014-8144] CSRF vulnerability in doorkeeper mailing-list