CVE-2020-15223

Katalog CVE

CVSS 8.0 · High EPSS 1,6%

Kerentanan Improper Handling of Exceptional Conditions pada ory fosite. Skor CVSS 3.1 8.0 (High) menurut NVD.

Deskripsi (NVD)

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0

Rincian

Terbit di NVD

24 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.0 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-755: Improper Handling of Exceptional Conditions
CWE-754: Improper Check for Unusual or Exceptional Conditions

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319 patch · advisory pihak ketiga
• https://github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wm advisory pihak ketiga
• https://tools.ietf.org/html/rfc7009#section-2.2.1 advisory pihak ketiga