CVE-2018-1000088 - CVE House
Back to Database
Status published Medium CVE-2018-1000088

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting...

Vulnerability Description

Doorkeeper version 2.1.0 through 4.2.5 contains a Cross Site Scripting (XSS) vulnerability in web view's OAuth app form, user authorization prompt web view that can result in Stored XSS on the OAuth Client's name will cause users interacting with it will execute payload. This attack appear to be exploitable via The victim must be tricked to click an opaque link to the web view that runs the XSS payload. A malicious version virtually indistinguishable from a normal link.. This vulnerability appears to have been fixed in 4.2.6, 4.3.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-1000088

Credits & Attribution

No credits recorded in the NVD database.

References

More from doorkeeper project

View All →
CVE-2020-10187
Doorkeeper version 5.0.0 and later contains an information disclosure vulnerability...
High 7.5
CVE-2018-1000211
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control...
High 7.5
CVE-2016-6582
The Doorkeeper gem before 4.2.0 for Ruby might allow remote...
Critical 9.1
CVE-2014-8144
Cross-site request forgery (CSRF) vulnerability in doorkeeper before 1.4.1 allows...
Medium 6.8

Affected Vendor

doorkeeper project

View all reports →

Affected Software

doorkeeper
Vulnerable Versions:
2.1.0

Timeline

Official Publish: March 13th, 2018
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.