CVE-2024-21632
High
Description
omniauth-microsoft_graph provides an Omniauth strategy for the Microsoft Graph API. Prior to versions 2.0.0, the implementation did not validate the legitimacy of the `email` attribute of the user nor did it give/document an option to do so, making it susceptible to nOAuth misconfiguration in cases when the `email` is used as a trusted user identifier. This could lead to account takeover. Version 2.0.0 contains a fix for this issue.
SeverityHigh
CVSS8.6
Exploit probability—
ProductRecognizeapp Omniauth\
PublishedJan 2, 2024
First seenJan 2, 2024
Weakness typeCWE-287Improper authentication
How to fix
Update
- recognizeapp omniauth\2.0.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| recognizeapp omniauth\ | \ ≤ v < 2.0.0 | 2.0.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.