Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-10187

CVE-2020-10187: Exposure of Sensitive Information to an Unauthorized Actor in Doorkeeper

7.5

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-10187
GHSA ID
GHSA-j7vx-8mqj-cqp9
EPSS Score
0.61394%
CWE
CWE-862
Published
5/7/2020
Updated
5/4/2023
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
doorkeeperrubygems>= 5.0.0, < 5.0.35.0.3
doorkeeperrubygems= 5.1.05.1.1
doorkeeperrubygems>= 5.2.0, < 5.2.55.2.5
doorkeeperrubygems>= 5.3.0, < 5.3.25.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the Application model's serialization logic. The commit fix shows the #as_json method was modified to add authorization checks (current_resource_owner validation) and attribute filtering. The workaround instructions explicitly mention patching this method, and the CWE-862 (Missing Authorization) aligns with uncontrolled data exposure via serialization. The controllers (applications_controller.rb) were also updated to pass ownership context, but the root vulnerability lies in the model's serialization method.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t In*orm*tion *is*losur* vuln*r**ility. *llows *n *tt**k*r to s** *ll `*oork**p*r::*ppli**tion` mo**l *ttri*ut* v*lu*s (in*lu*in* s**r*ts) usin* *ut*oriz** *ppli**tions *ontroll*r i* it's *n**l** (**T /o*ut*/*ut*oriz**_*ppli**tions.json). #

Reasoning

T** vuln*r**ility st*ms *rom t** *ppli**tion mo**l's s*ri*liz*tion lo*i*. T** *ommit *ix s*ows t** #*s_json m*t*o* w*s mo*i*i** to *** *ut*oriz*tion ****ks (*urr*nt_r*sour**_own*r v*li**tion) *n* *ttri*ut* *ilt*rin*. T** work*roun* instru*tions *xpli