CVE-2020-15234

Katalog CVE

CVSS 4.8 · Medium EPSS 0,84%

Kerentanan Improper Input Validation pada ory fosite. Skor CVSS 3.1 4.8 (Medium) menurut NVD.

Deskripsi (NVD)

ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered redirect URLs and the redirect URL provided at the OAuth2 Authorization Endpoint where compared using strings.ToLower while they should have been compared with a simple string match. This allows an attacker to register a client with allowed redirect URL https://example.com/callback. Then perform an OAuth2 flow and requesting redirect URL https://example.com/CALLBACK. Instead of an error (invalid redirect URL), the browser is redirected to https://example.com/CALLBACK with a potentially successful OAuth2 response, depending on the state of the overall OAuth2 flow (the user might still deny the request for example). This vulnerability has been patched in ORY Fosite v0.34.1.

Rincian

Terbit di NVD

2 Oktober 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

4.8 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
CWE-178: Improper Handling of Case Sensitivity

EPSS (30 hari)

0,84% peluang dieksploitasi; lebih tinggi dari 56,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ory/fosite/commit/cdee51ebe721bfc8acca0fd0b86b030ca70867bf patch · advisory pihak ketiga
• https://github.com/ory/fosite/security/advisories/GHSA-grfp-q2mm-hfp6 advisory pihak ketiga