CVE Feed

    Dashboard / CVE / CVE-2023-50708

    CVE-2023-50708

    yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.

    Published:Dec 22, 2023
    Last Modified:Nov 21, 2024
    EPS:Dec 22, 2023
    EPSS Score:0.00162
    CVSS Score:6.1

    Affected Products

    Vendor
    Yiiframework
    Product
    Yii2-authclient

    Exploits

    https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xphttps://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp

    Common Weakness Enumeration

    CWE-203 Observable Discrepancy

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-189 Black Box Reverse Engineering

    References

    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158
    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121
    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420
    https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248
    https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp
    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158
    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121
    https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420
    https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248
    https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High