ScratchOAuth2 における不正な認証に関する脆弱性
| Title |
ScratchOAuth2 における不正な認証に関する脆弱性
|
| Summary |
ScratchOAuth2 には、不正な認証に関する脆弱性が存在します。
|
| Possible impacts |
情報を取得される、および情報を改ざんされる可能性があります。 |
| Solution |
ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。 |
| Publication Date |
April 13, 2021, midnight |
| Registration Date |
Dec. 20, 2021, 6:15 p.m. |
| Last Update |
Dec. 20, 2021, 6:15 p.m. |
|
CVSS3.0 : 警告
|
| Score |
6.8
|
| Vector |
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N |
|
CVSS2.0 : 警告
|
| Score |
4
|
| Vector |
AV:N/AC:H/Au:N/C:P/I:P/A:N |
Affected System
| ScratchOAuth2 project |
|
ScratchOAuth2
|
CVE (情報セキュリティ 共通脆弱性識別子)
CWE (共通脆弱性タイプ一覧)
ベンダー情報
Change Log
| No |
Changed Details |
Date of change |
| 1 |
[2021年12月20日]
掲載 |
Dec. 20, 2021, 6:15 p.m. |
NVD Vulnerability Information
CVE-2021-29437
| Summary |
ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.
|
| Publication Date |
April 14, 2021, 5:15 a.m. |
| Registration Date |
April 14, 2021, 10:05 a.m. |
| Last Update |
Nov. 21, 2024, 3:01 p.m. |
Affected software configurations
| Configuration1 |
or higher |
or less |
more than |
less than |
| cpe:2.3:a:scratchoauth2_project:scratchoauth2:*:*:*:*:*:scratch:*:* |
|
|
|
2021-04-13 |
Related information, measures and tools
Common Vulnerabilities List