// For flags

CVE-2023-50714

The Oauth2 PKCE implementation is vulnerable

Severity Score

8.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.

yii2-authclient es una extensión que agrega consumidores OpenID, OAuth, OAuth2 y OpenId Connect para el framework Yii 2.0. En yii2-authclient anterior a la versión 2.2.15, la implementación de Oauth2 PKCE es vulnerable de 2 maneras. Primero, "authCodeVerifier" debe eliminarse después de su uso (similar a "authState"). En segundo lugar, existe el riesgo de un "downgrade attack" si se confía en PKCE para la protección CSRF. La versión 2.2.15 contiene un parche para el problema. No hay workarounds disponibles.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2023-12-11 CVE Reserved
  • 2023-12-22 CVE Published
  • 2024-01-09 EPSS Updated
  • 2024-08-02 CVE Updated
  • 2024-08-02 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-287: Improper Authentication
  • CWE-347: Improper Verification of Cryptographic Signature
  • CWE-918: Server-Side Request Forgery (SSRF)
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Yiiframework
Search vendor "Yiiframework"
 Yii2-authclient
Search vendor "Yiiframework" for product "Yii2-authclient"
 < 2.2.15
Search vendor "Yiiframework" for product "Yii2-authclient" and version " < 2.2.15"
-
Affected