RubyGems/doorkeeper CVE-2018-1000088: medium 6.1, EPSS 1.43%

Doorkeeper is vulnerable to stored XSS and code execution

Action: Upgrade doorkeeper to 4.2.6 or later.

bundle update doorkeeper

Affected

Fixed versions

Sources

• osv: GHSA-hwhh-2fwm-cfgw
• https://nvd.nist.gov/vuln/detail/CVE-2018-1000088
• https://github.com/doorkeeper-gem/doorkeeper/issues/969
• https://github.com/doorkeeper-gem/doorkeeper/pull/970
• https://github.com/rubysec/ruby-advisory-db/pull/328/files
• https://github.com/doorkeeper-gem/doorkeeper/commit/7b1a8373ecd69768c896000c7971dbf48948c1b5
• https://blog.justinbull.ca/cve-2018-1000088-stored-xss-in-doorkeeper
• https://github.com/doorkeeper-gem/doorkeeper
• https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.3.0
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/doorkeeper/CVE-2018-1000088.yml

CVE-2018-1000088 · published 2018-03-13T20:44:48Z · modified 2024-02-16T08:00:57.387423Z · JSON