Improper Authorization

2020-07-1305:26:51

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.007 Low

EPSS

Percentile

79.8%

JSON

Google OAuth Client is vulnerable to improper authorization. Due to a flaw in implementation for Proof Key for Code Exchange (PKCE), the code sent by authorization server is not properly handled to authorize the client that issued the initial authorization request, allowing an attacker with a malicious application on the client-side to gain authorization to the protected resource.

CPENameOperatorVersion
google oauth client library for javale1.30.6
google oauth client library for javale1.30.6
jenkins-2-pluginseq4.8.1642420115__1.el8
jenkins-2-pluginseq4.8.1633555500__1.el8
jenkins-2-pluginseq4.9.1642607680__1.el8
jenkins-2-pluginseq4.9.1651754460__1.el8
jenkins-2-pluginseq4.7.1652967082__1.el8
jenkins-2-pluginseq4.6.1643965689__1.el8
jenkins-2-pluginseq4.6.1609853716__1.el8
jenkins-2-pluginseq4.9.1669894222__1.el8

Name	Operator	Version
google oauth client library for java	le	1.30.6
google oauth client library for java	le	1.30.6
jenkins-2-plugins	eq	4.8.1642420115__1.el8
jenkins-2-plugins	eq	4.8.1633555500__1.el8
jenkins-2-plugins	eq	4.9.1642607680__1.el8
jenkins-2-plugins	eq	4.9.1651754460__1.el8
jenkins-2-plugins	eq	4.7.1652967082__1.el8
jenkins-2-plugins	eq	4.6.1643965689__1.el8
jenkins-2-plugins	eq	4.6.1609853716__1.el8
jenkins-2-plugins	eq	4.9.1669894222__1.el8