PT-2022-12619 · Unknown · Scratchoauth2

Apple502J · Published 2022-02-15 · Updated 2022-02-24 · CVE-2021-46250

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AC:L/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:N

Name of the Vulnerable Software and Affected Versions ScratchOAuth2 versions before commit a91879bd58fa83b09283c0708a1864cdf067c64a

Description An issue in SOA2Login::commented of ScratchOAuth2 allows attackers to authenticate as other users on downstream components that rely on ScratchOAuth2.

Recommendations For ScratchOAuth2 versions before commit a91879bd58fa83b09283c0708a1864cdf067c64a, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the SOA2Login::commented function until a patch is available.

Fix

Related Identifiers

CVE-2021-46250

Affected Products

Scratchoauth2

References · 5

• https://github.com/ScratchVerifier/ScratchOAuth2/commit/a91879bd58fa83b09283c0708a1864cdf067c64a · Patch
• https://osv.dev/vulnerability/CVE-2021-46250 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46250 · Security Note
• https://t.me/cvenotify/26836 · Telegram Post
• https://t.me/cibsecurity/37549 · Telegram Post