Описание
The Client secret is not checked when using the OAuth Password grant type.
By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
EPSS
Процентиль: 11%
0.00038
Низкий
Дефекты
CWE-358
Связанные уязвимости
github
около 1 года назад
The Client secret is not checked when using the OAuth Password grant type. By exploiting this vulnerability, an attacker could connect to a web server using a client application not explicitly authorized as part of the OAuth deployment. Exploitation requires valid credentials and does not permit the attacker to bypass user privileges.
EPSS
Процентиль: 11%
0.00038
Низкий
Дефекты
CWE-358