CVE-2014-8144

描述

Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows remote attackers to hijack the authentication of unspecified victims for requests that read a user OAuth authorization code via unknown vectors.

如何修補 CVE-2014-8144

要修補 CVE-2014-8144,請將受影響套件升級到下列已修補版本。

• RubyGems/doorkeeper—升級至 1.4.1 或更新版本

CVE-2014-8144 正在被利用嗎?

低 — EPSS 為 0.7%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 1.4.1

參考連結(5)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-8144
• PATCHgithub.com/doorkeeper-gem/doorkeeper
• WEBseclists.org/oss-sec/2014/q4/1076
• WEBexchange.xforce.ibmcloud.com/vulnerabilities/99342
• WEB