CVE-2020-15223

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-755 CWE-754

Affected software

No affected versions have been published.

Timeline

Published: Sep 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-152246.8In Open Enclave before version 0.12.0, an information disclosure vulnerability exists when an enclave application using the syscalls provide CVE-2020-152256.5django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatica CVE-2020-152264.3In GLPI before version 9.5.2, there is a SQL Injection in the API's search function. Not only is it possible to break the SQL syntax, but it CVE-2020-152279.8Nette versions before 2.0.19, 2.1.13, 2.2.10, 2.3.14, 2.4.16, 3.0.6 are vulnerable to an code injection attack by passing specially formed p CVE-2020-152285.0In the `@actions/core` npm module before version 1.2.6,`addPath` and `exportVariable` functions communicate with the Actions Runner over std CVE-2020-152299.3Singularity (an open source container platform) from version 3.1.1 through 3.6.3 has a vulnerability. Due to insecure handling of path trave CVE-2020-15238.9<p>A tampering vulnerability exists when Microsoft SharePoint Server fails to properly handle profile data. An attacker who successfully exp CVE-2020-152306.5Vapor is a web framework for Swift. In Vapor before version 4.29.4, Attackers can access data at arbitrary filesystem paths on the same host CVE-2020-152316.1In mapfish-print before version 3.24, a user can use the JSONP support to do a Cross-site scripting.CVE-2020-152329.1In mapfish-print before version 3.24, a user can do to an XML External Entity (XXE) attack with the provided SDL style.CVE-2020-152334.8ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite from version 0.30.2 and before version 0.34.1, there is a CVE-2020-152344.8ORY Fosite is a security first OAuth2 & OpenID Connect framework for Go. In Fosite before version 0.34.1, the OAuth 2.0 Client's registered