CVE-2016-6582

Published: Jan 23, 2017Modified: May 13, 2026

9.1

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

The Doorkeeper gem before 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens by leveraging failure to implement the OAuth 2.0 Token Revocation specification.

Affected (1)

Products: Doorkeeper Project: Doorkeeper

Doorkeeper Project

1 product

Doorkeeper

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Doorkeeper Project Doorkeeper	Up to 4.1.0

Related CWEs

CWE-254

References (12)

http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://seclists.org/fulldisclosure/2016/Aug/105

Source: cve@mitre.org

Mailing ListPatchThird Party Advisory

http://www.securityfocus.com/archive/1/539268/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/92551

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://github.com/doorkeeper-gem/doorkeeper/issues/875

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/doorkeeper-gem/doorkeeper/releases/tag/v4.2.0

Source: cve@mitre.org

Issue TrackingPatchRelease NotesThird Party Advisory

http://packetstormsecurity.com/files/138430/Doorkeeper-4.1.0-Token-Revocation.html