Package Instance
Lookup for vulnerable packages by Package URL.
GET /api/packages/162250?format=api
{ "url": "http://public2.vulnerablecode.io/api/packages/162250?format=api", "purl": "pkg:gem/doorkeeper@2.1.1", "type": "gem", "namespace": "", "name": "doorkeeper", "version": "2.1.1", "qualifiers": {}, "subpath": "", "is_vulnerable": true, "next_non_vulnerable_version": "5.6.6", "latest_non_vulnerable_version": "5.6.6", "affected_by_vulnerabilities": [ { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/45356?format=api", "vulnerability_id": "VCID-bss3-b2mz-gyg6", "summary": "Doorkeeper Improper Authentication vulnerability\nOAuth RFC 8252 says https://www.rfc-editor.org/rfc/rfc8252#section-8.6\n\n> the authorization server SHOULD NOT process authorization requests automatically without user consent or interaction, except when the identity of the client can be assured. **This includes the case where the user has previously approved an authorization request for a given client id**\n\nBut Doorkeeper automatically processes authorization requests without user consent for public clients that have been previously approved. Public clients are inherently vulnerable to impersonation, their identity cannot be assured.\n\nIssue https://github.com/doorkeeper-gem/doorkeeper/issues/1589\n\nFix https://github.com/doorkeeper-gem/doorkeeper/pull/1646", "references": [ { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/issues/1589", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/issues/1589" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/pull/1646", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/pull/1646" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v5.6.6" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2023/07/msg00016.html" }, { "reference_url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00010.html" }, { "reference_url": "https://www.rfc-editor.org/rfc/rfc8252#section-8.6", "reference_id": "", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://www.rfc-editor.org/rfc/rfc8252#section-8.6" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038950", "reference_id": "1038950", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1038950" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34246", "reference_id": "CVE-2023-34246", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-34246" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml", "reference_id": "CVE-2023-34246.YML", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2023-34246.yml" }, { "reference_url": "https://github.com/advisories/GHSA-7w2c-w47h-789w", "reference_id": "GHSA-7w2c-w47h-789w", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-7w2c-w47h-789w" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w", "reference_id": "GHSA-7w2c-w47h-789w", "reference_type": "", "scores": [ { "value": "4.2", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/security/advisories/GHSA-7w2c-w47h-789w" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/65372?format=api", "purl": "pkg:gem/doorkeeper@5.6.6", "is_vulnerable": false, "affected_by_vulnerabilities": [], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@5.6.6" } ], "aliases": [ "CVE-2023-34246", "GHSA-7w2c-w47h-789w" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-bss3-b2mz-gyg6" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/40094?format=api", "vulnerability_id": "VCID-jqsd-ye8h-hfd1", "summary": "Incorrect Permission Assignment for Critical Resource\nDoorkeeper contains a vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000211", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00265", "scoring_system": "epss", "scoring_elements": "0.50192", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000211" }, { "reference_url": "https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://blog.justinbull.ca/cve-2018-1000211-public-apps-cant-revoke-tokens-in-doorkeeper/" }, { "reference_url": "https://github.com/advisories/GHSA-694m-jhr9-pf77", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-694m-jhr9-pf77" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/issues/891", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/issues/891" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/pull/1119", "reference_id": "", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/pull/1119" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903980", "reference_id": "903980", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=903980" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000211", "reference_id": "CVE-2018-1000211", "reference_type": "", "scores": [ { "value": "7.5", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" }, { "value": "HIGH", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000211" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/56116?format=api", "purl": "pkg:gem/doorkeeper@4.2.5", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bss3-b2mz-gyg6" }, { "vulnerability": "VCID-vfr9-mu8k-rbg5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@4.2.5" }, { "url": "http://public2.vulnerablecode.io/api/packages/143703?format=api", "purl": "pkg:gem/doorkeeper@4.4.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bss3-b2mz-gyg6" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@4.4.0" } ], "aliases": [ "CVE-2018-1000211", "GHSA-694m-jhr9-pf77" ], "risk_score": 4.0, "exploitability": "0.5", "weighted_severity": "8.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jqsd-ye8h-hfd1" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/39476?format=api", "vulnerability_id": "VCID-vfr9-mu8k-rbg5", "summary": "XSS on authorization consent view\nStored XSS on the OAuth Client's name will cause users being prompted for consent via the `implicit` grant type to execute the XSS payload. The XSS attack could gain access to the user's active session, resulting in account compromise. Any user is susceptible if they click the authorization link for the malicious OAuth client. Because of how the links work, a user cannot tell if a link is malicious or not without first visiting the page with the XSS payload. In addition, there is stored XSS in the `native_redirect_uri` form element.", "references": [ { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000088", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00174", "scoring_system": "epss", "scoring_elements": "0.38497", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-1000088" }, { "reference_url": "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/commit/7b1a8373ecd69768c896000c7971dbf48948c1b5", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/commit/7b1a8373ecd69768c896000c7971dbf48948c1b5" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/issues/969", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/issues/969" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/pull/970", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/pull/970" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2018-1000088.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2018-1000088.yml" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/pull/328/files", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/pull/328/files" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000088", "reference_id": "", "reference_type": "", "scores": [ { "value": "6.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N" }, { "value": "MODERATE", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000088" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891069", "reference_id": "891069", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891069" }, { "reference_url": "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/", "reference_id": "CVE-2018-1000088-STORED-XSS-IN-DOORKEEPER", "reference_type": "", "scores": [ { "value": "7.6", "scoring_system": "cvssv3", "scoring_elements": "" } ], "url": "https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper/" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/55170?format=api", "purl": "pkg:gem/doorkeeper@4.2.6", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bss3-b2mz-gyg6" }, { "vulnerability": "VCID-vfr9-mu8k-rbg5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@4.2.6" } ], "aliases": [ "CVE-2018-1000088", "GHSA-hwhh-2fwm-cfgw" ], "risk_score": 3.1, "exploitability": "0.5", "weighted_severity": "6.2", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-vfr9-mu8k-rbg5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/38460?format=api", "vulnerability_id": "VCID-xa34-b97y-tye5", "summary": "Broken token revocation, wrong auth/auth method\nDoorkeeper failed to implement OAuth Token Revocation (RFC ) in the following ways: Public clients making valid, unauthenticated calls to revoke a token would not have their token revoked Requests were not properly authenticating the *client credentials* but were, instead, looking at the access token in a second location Because of 2, the requests were also not authorizing confidential clients' ability to revoke a given token. It should only revoke tokens that belong to it. The security implication is: OAuth clients who \"log out\" a user expect to have the corresponding access & refresh tokens revoked, preventing an attacker who may have already hijacked the session from continuing to impersonate the victim. Because of the bug described above, this is not the case. As far as OWASP is concerned, this counts as broken authentication design. MITRE has assigned CVE-2016-6582 due to the security issues raised. An attacker, thanks to 1, can replay a hijacked session after a victim logs out/revokes their token. Additionally, thanks to 2 & 3, an attacker via a compromised confidential client could \"grief\" other clients by revoking their tokens (albeit this is an exceptionally narrow attack with little value).", "references": [ { "reference_url": "http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html" }, { "reference_url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6582", "reference_id": "", "reference_type": "", "scores": [ { "value": "0.00988", "scoring_system": "epss", "scoring_elements": "0.77196", "published_at": "2026-06-04T12:55:00Z" } ], "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-6582" }, { "reference_url": "http://seclists.org/fulldisclosure/2016/Aug/105", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://seclists.org/fulldisclosure/2016/Aug/105" }, { "reference_url": "https://github.com/advisories/GHSA-3m6r-39p3-jq25", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/advisories/GHSA-3m6r-39p3-jq25" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/commit/fb938051777a3c9cb071e96fc66458f8f615bd53", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/doorkeeper-gem/doorkeeper/commit/fb938051777a3c9cb071e96fc66458f8f615bd53" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/issues/875", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/issues/875" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0" }, { "reference_url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2016-6582.yml" }, { "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6582", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6582" }, { "reference_url": "https://web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20170214021758/http://www.securityfocus.com/bid/92551" }, { "reference_url": "https://web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "https://web.archive.org/web/20201207202519/http://www.securityfocus.com/archive/1/539268/100/0/threaded" }, { "reference_url": "http://www.openwall.com/lists/oss-security/2016/08/19/2", "reference_id": "", "reference_type": "", "scores": [ { "value": "9.1", "scoring_system": "cvssv3", "scoring_elements": "" }, { "value": "9.1", "scoring_system": "cvssv3.1", "scoring_elements": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H" }, { "value": "CRITICAL", "scoring_system": "generic_textual", "scoring_elements": "" } ], "url": "http://www.openwall.com/lists/oss-security/2016/08/19/2" }, { "reference_url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834843", "reference_id": "834843", "reference_type": "", "scores": [], "url": "https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=834843" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/53234?format=api", "purl": "pkg:gem/doorkeeper@4.2.0", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bss3-b2mz-gyg6" }, { "vulnerability": "VCID-jqsd-ye8h-hfd1" }, { "vulnerability": "VCID-vfr9-mu8k-rbg5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@4.2.0" } ], "aliases": [ "CVE-2016-6582", "GHSA-3m6r-39p3-jq25" ], "risk_score": 4.5, "exploitability": "0.5", "weighted_severity": "9.0", "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-xa34-b97y-tye5" }, { "url": "http://public2.vulnerablecode.io/api/vulnerabilities/37801?format=api", "vulnerability_id": "VCID-ypak-x4hq-6qgt", "summary": "Sensitive information in production logs\nThe program stores sensitive information in production logs. This may allow a local attacker to gain access to sensitive information.", "references": [ { "reference_url": "https://github.com/apsoto/doorkeeper/commit/ff434bb8fc49e132bff4d0f974ee0c1a8a69c143", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/apsoto/doorkeeper/commit/ff434bb8fc49e132bff4d0f974ee0c1a8a69c143" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/commit/d6bca5f32b741b8cee83a4aeb818338b919181fe", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/doorkeeper-gem/doorkeeper/commit/d6bca5f32b741b8cee83a4aeb818338b919181fe" }, { "reference_url": "https://github.com/doorkeeper-gem/doorkeeper/issues/576", "reference_id": "", "reference_type": "", "scores": [], "url": "https://github.com/doorkeeper-gem/doorkeeper/issues/576" }, { "reference_url": "http://www.osvdb.com/show/osvdb/118830", "reference_id": "", "reference_type": "", "scores": [], "url": "http://www.osvdb.com/show/osvdb/118830" } ], "fixed_packages": [ { "url": "http://public2.vulnerablecode.io/api/packages/52149?format=api", "purl": "pkg:gem/doorkeeper@2.1.2", "is_vulnerable": true, "affected_by_vulnerabilities": [ { "vulnerability": "VCID-bss3-b2mz-gyg6" }, { "vulnerability": "VCID-jqsd-ye8h-hfd1" }, { "vulnerability": "VCID-vfr9-mu8k-rbg5" }, { "vulnerability": "VCID-xa34-b97y-tye5" } ], "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@2.1.2" } ], "aliases": [ "OSVDB-118830" ], "risk_score": null, "exploitability": null, "weighted_severity": null, "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-ypak-x4hq-6qgt" } ], "fixing_vulnerabilities": [], "risk_score": "3.1", "resource_url": "http://public2.vulnerablecode.io/packages/pkg:gem/doorkeeper@2.1.1" }