CVE-2020-15223: Ignored storage errors on token revokation in ORY Fosite
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the TokenRevocationHandler ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-15223?
CVE-2020-15223 has a medium severity level due to the potential for token revocation to be reported as successful when it isn't.
How do I fix CVE-2020-15223?
To fix CVE-2020-15223, upgrade to ORY Fosite version 0.34.0 or later, where the issue has been addressed.
What does CVE-2020-15223 affect?
CVE-2020-15223 affects all versions of ORY Fosite prior to version 0.34.0.
What are the consequences of CVE-2020-15223?
The consequences of CVE-2020-15223 include the risk of tokens remaining valid despite being revoked, which could lead to unauthorized access.
Is CVE-2020-15223 an active vulnerability?
As of now, CVE-2020-15223 is considered a resolved vulnerability if the affected software has been updated accordingly.