CVE-2023-50708

CVSS V2 None CVSS V3 None
Description
yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.
Overview
  • CVE ID
  • CVE-2023-50708
  • Assigner
  • GitHub_M
  • Vulnerability Status
  • PUBLISHED
  • Published Version
  • 2023-12-22T18:25:01.925Z
  • Last Modified Date
  • 2023-12-22T18:25:01.925Z
Weakness Enumerations
CWE URL
CWE-203 http://cwe.mitre.org/data/definitions/203.html
References
Reference URL Reference Tags
https://github.com/yiisoft/yii2-authclient/security/advisories/GHSA-w8vh-p74j-x9xp x_refsource_CONFIRM
https://github.com/yiisoft/yii2-authclient/commit/dabddf2154ab7e7703740205a069202554089248 x_refsource_MISC
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth1.php#L158 x_refsource_MISC
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OAuth2.php#L121 x_refsource_MISC
https://github.com/yiisoft/yii2-authclient/blob/0d1c3880f4d79e20aa1d77c012650b54e69695ff/src/OpenIdConnect.php#L420 x_refsource_MISC
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2023-50708
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-50708
History
Created Old Value New Value Data Type Notes
2024-06-25 18:42:30 Added to TrackCVE