GHSA-7mqr-2v3q-v2wm

    Dashboard / Vulnerabilities / GHSA-7mqr-2v3q-v2wm

    GHSA-7mqr-2v3q-v2wm

    Published: 24 May 2021Last Modified: 10 Sept 2026

    Summary: Ory fosite contains Improper Handling of Exceptional Conditions

    Details: ### Impact The `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. ### References [RFC 7009](https://tools.ietf.org/html/rfc7009#section-2.2.1) states that a 503 HTTP code must be returned when the server has a problem.

    References: https://github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wm, https://nvd.nist.gov/vuln/detail/CVE-2020-15223, https://github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319, https://pkg.go.dev/vuln/GO-2021-0109, https://tools.ietf.org/html/rfc7009#section-2.2.1

    Affected packages

    Package

    Name: github.com/ory/fosite

    Purl: pkg:golang/github.com/ory/fosite

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.34.0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-7mqr-2v3q-v2wm | CVE-DB