-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stemmed from using the unverified 'email' claim as a trusted identifier. The pre-patch implementation lacked: 1) Comparison between email domain and userPrincipalName domain, 2) Validation of the xms_edov claim. The auth_hash method was particularly vulnerable as it's responsible for constructing the authentication hash from raw OAuth data without validation. The raw_info method provided the unvalidated email data that fed into this process. The patch added DomainVerifier checks in auth_hash to address these issues.
RubyRuby| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| omniauth-microsoft_graph | rubygems | < 2.0.0 | 2.0.0 |
Ongoing coverage of React2Shell