Vulnerability in Ory Fosite
CVE-2020-15223
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
EPSS: 0.016 (73.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.0 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N.
Affected products
- Ory Fosite — versions < 0.34.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
- security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)
- security-advisories@github.com (Third Party Advisory, x_refsource_MISC)
Frequently asked questions
- What is CVE-2020-15223?
- CVE-2020-15223 is a high-severity vulnerability in Ory Fosite, classified under Improper Handling of Exceptional Conditions. CVSS score: 8.0/10. Published 2020-09-24.
- How severe is CVE-2020-15223?
- High severity. CVSS v3 base score is 8.0 out of 10.
- Is CVE-2020-15223 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.