Vulnerabilities > CVE-2020-15223 - Improper Check for Unusual or Exceptional Conditions vulnerability in ORY Fosite

CVSS 8.0 - HIGH

Attack vector

NETWORK

Attack complexity

HIGH

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

NONE

network

high complexity

ory

CWE-754

NVD

Published: 2020-09-24

Updated: 2022-10-21

Summary

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0

Vulnerable Configurations

Part	Description	Count
Application	Ory ORY Fosite - ORY Fosite 0.1.0 ORY Fosite 0.2.0 ORY Fosite 0.2.1 ORY Fosite 0.2.2 ORY Fosite 0.2.3 ORY Fosite 0.2.4 ORY Fosite 0.3.0 ORY Fosite 0.3.1 ORY Fosite 0.3.2 ORY Fosite 0.3.3 ORY Fosite 0.3.4 ORY Fosite 0.3.5 ORY Fosite 0.3.6 ORY Fosite 0.4.0 ORY Fosite 0.5.0 ORY Fosite 0.5.1 ORY Fosite 0.6.0 ORY Fosite 0.6.1 ORY Fosite 0.6.2 ORY Fosite 0.6.3 ORY Fosite 0.6.4 ORY Fosite 0.6.5 ORY Fosite 0.6.6 ORY Fosite 0.6.7 ORY Fosite 0.6.8 ORY Fosite 0.6.9 ORY Fosite 0.6.10 ORY Fosite 0.6.11 ORY Fosite 0.6.12 ORY Fosite 0.6.13 ORY Fosite 0.6.14 ORY Fosite 0.6.15 ORY Fosite 0.6.17 ORY Fosite 0.6.18 ORY Fosite 0.6.19 ORY Fosite 0.7.0 ORY Fosite 0.8.0 ORY Fosite 0.9.0 ORY Fosite 0.9.1 ORY Fosite 0.9.2 ORY Fosite 0.9.3 ORY Fosite 0.9.4 ORY Fosite 0.9.5 ORY Fosite 0.9.6 ORY Fosite 0.9.7 ORY Fosite 0.10.0 ORY Fosite 0.11.0 ORY Fosite 0.11.1 ORY Fosite 0.11.2 ORY Fosite 0.11.3 ORY Fosite 0.11.4 ORY Fosite 0.12.0 ORY Fosite 0.13.0 ORY Fosite 0.13.1 ORY Fosite 0.14.0 ORY Fosite 0.14.1 ORY Fosite 0.14.2 ORY Fosite 0.15.0 ORY Fosite 0.15.1 ORY Fosite 0.15.2 ORY Fosite 0.15.3 ORY Fosite 0.15.4 ORY Fosite 0.15.5 ORY Fosite 0.15.6 ORY Fosite 0.16.0 ORY Fosite 0.16.1 ORY Fosite 0.16.2 ORY Fosite 0.16.3 ORY Fosite 0.16.4 ORY Fosite 0.16.5 ORY Fosite 0.17.0 ORY Fosite 0.17.1 ORY Fosite 0.17.2 ORY Fosite 0.18.0 ORY Fosite 0.18.1 ORY Fosite 0.19.0 ORY Fosite 0.19.1 ORY Fosite 0.19.2 ORY Fosite 0.19.3 ORY Fosite 0.19.4 ORY Fosite 0.19.5 ORY Fosite 0.19.6 ORY Fosite 0.19.7 ORY Fosite 0.19.8 ORY Fosite 0.20.0 ORY Fosite 0.20.1 ORY Fosite 0.20.2 ORY Fosite 0.20.3 ORY Fosite 0.21.0 ORY Fosite 0.21.1 ORY Fosite 0.21.2 ORY Fosite 0.21.3 ORY Fosite 0.21.4 ORY Fosite 0.21.5 ORY Fosite 0.22.0 ORY Fosite 0.23.0 ORY Fosite 0.24.0 ORY Fosite 0.25.0 ORY Fosite 0.25.1 ORY Fosite 0.26.0 ORY Fosite 0.26.1 ORY Fosite 0.27.0 ORY Fosite 0.27.1 ORY Fosite 0.27.2 ORY Fosite 0.27.3 ORY Fosite 0.27.4 ORY Fosite 0.28.0 ORY Fosite 0.28.1 ORY Fosite 0.29.0 ORY Fosite 0.29.1 ORY Fosite 0.29.2 ORY Fosite 0.29.3 ORY Fosite 0.29.4 ORY Fosite 0.29.5 ORY Fosite 0.29.6 ORY Fosite 0.29.7 ORY Fosite 0.29.8 ORY Fosite 0.30.0 ORY Fosite 0.30.1 ORY Fosite 0.30.2 ORY Fosite 0.30.3 ORY Fosite 0.30.4 ORY Fosite 0.30.5 ORY Fosite 0.30.6 ORY Fosite 0.31.0 ORY Fosite 0.31.1 ORY Fosite 0.31.2 ORY Fosite 0.31.3 ORY Fosite 0.32.0 ORY Fosite 0.32.1 ORY Fosite 0.32.2 ORY Fosite 0.32.3 ORY Fosite 0.32.4 ORY Fosite 0.33.0	135

Common Weakness Enumeration (CWE)

CWE-754 - Improper Check for Unusual or Exceptional Conditions

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References