CVE-2020-15223: Ignored storage errors on token revokation in ORY Fosite
Vulnerability summary
CVE-2020-15223 is a high (CVSS 8.0) vulnerability in ory fosite. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.6% of scored vulnerabilities.
Not severe (CVSS 8, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 24-09-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
In ORY Fosite (the security first OAuth2 & OpenID Connect framework for Go) before version 0.34.0, the `TokenRevocationHandler` ignores errors coming from the storage. This can lead to unexpected 200 status codes indicating successful revocation while the token is still valid. Whether an attacker can use this for her advantage depends on the ability to trigger errors in the store. This is fixed in version 0.34.0
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · GoEcosystem advisory · calculated8.0HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
- NVDNIST8.0HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
EPSS trend
Probability
1.59%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.59% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
- CWE-754Improper Check for Unusual or Exceptional ConditionsThe product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
Affected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Github.com/ory1 product
- fosite< 0.34.0
Ory1 product
- fosite< 0.34.0
2 vendors · 2 products
References
5 links- github.com/ory/fosite/security/advisories/GHSA-7mqr-2v3q-v2wmX Refsource CONFIRMWEBThird Party Advisory
- github.com/ory/fosite/commit/03dd55813f5521985f7dd64277b7ba0cf1441319X Refsource MISCWEBFIXPatchThird Party Advisory
