PT-2021-18213 · Unknown · Scratchoauth2

Kenny2Github + 1 · Published 2021-04-13 · Updated 2023-06-26 · CVE-2021-29437

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ScratchOAuth2 (affected versions not specified)

Description: The issue allows a third-party site to access and modify a Scratch user's data by pretending to be the user and obtaining a login code from ScratchOAuth2. This is achieved through a series of steps where the third-party site tricks the user into posting a login code on their profile, which the third-party site then uses to complete the login process and gain full access to the user's account.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-29437

GHSA-GVPG-23FH-8G75

Affected Products

Scratchoauth2

References · 4

• https://github.com/ScratchVerifier/ScratchOAuth2/commit/9220c2a77eda3df37a84486ad722f1ad0985d8e7 · Patch
• https://github.com/ScratchVerifier/ScratchOAuth2/security/advisories/GHSA-gvpg-23fh-8g75 · Patch
• https://osv.dev/vulnerability/CVE-2021-29437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-29437 · Security Note