CVE-2023-37260
1 advisory.
Packagist/league/oauth2-server CVE-2023-37260: high 8.2, EPSS 0.95%
league/oauth2-server key exposed in exception message when passing as a string and providing an invalid pass phrase
Action: Upgrade league/oauth2-server to 8.4.2 or later.
composer require league/oauth2-server:8.4.2composer require league/oauth2-server:8.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 8.3.2 | 8.4.2 | - |
| 8.5.0 | 8.5.3 | - |
Fixed versions
| 8.4.2 | 8.5.3 |
Sources
- osv: GHSA-wj7q-gjg8-3cpm
- https://github.com/thephpleague/oauth2-server/security/advisories/GHSA-wj7q-gjg8-3cpm
- https://nvd.nist.gov/vuln/detail/CVE-2023-37260
- https://github.com/thephpleague/oauth2-server/pull/1353
- https://github.com/thephpleague/oauth2-server/pull/1359
- https://github.com/thephpleague/oauth2-server
- https://github.com/thephpleague/oauth2-server/releases/tag/8.5.3
CVE-2023-37260 · published · modified · JSON