CVE-2021-29437

MEDIUM Year: 2021
CVSS v3 Score
6.8
Medium
CVSS v2 Score
4.0
Medium
Weakness Type
CWE-863
View all →

Vulnerability Description

ScratchOAuth2 is an Oauth implementation for Scratch. Any ScratchOAuth2-related data normally accessible and modifiable by a user can be read and modified by a third party. 1. Scratch user visits 3rd party site. 2. 3rd party site asks user for Scratch username. 3. 3rd party site pretends to be user and gets login code from ScratchOAuth2. 4. 3rd party site gives code to user and instructs them to post it on their profile. 5. User posts code on their profile, not knowing it is a ScratchOAuth2 login code. 6. 3rd party site completes login with ScratchOAuth2. 7. 3rd party site has full access to anything the user could do if they directly logged in. See referenced GitHub security advisory for patch notes and workarounds.

Related Vulnerabilities

CVE-2013-2673

MEDIUM
CVSS:6.8(Medium)

Brother MFC-9970CDW 1.10 firmware L devices contain a security bypass vulnerability which allows physically proximate attackers to gain unauthorized access.

CWE-8632013

CVE-2017-12115

MEDIUM
CVSS:6.8(Medium)

An exploitable improper authorization vulnerability exists in miner_setEtherbase API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to...

CWE-8632017

CVE-2017-12116

MEDIUM
CVSS:6.8(Medium)

An exploitable improper authorization vulnerability exists in miner_setGasPrice API of cpp-ethereum's JSON-RPC (commit 4e1015743b95821849d001618a7ce82c7c073768). A JSON request can cause an access to ...

CWE-8632017

CVE-2017-16858

MEDIUM
CVSS:6.8(Medium)

The 'crowd-application' plugin module (notably used by the Google Apps plugin) in Atlassian Crowd from version 1.5.0 before version 3.1.2 allowed an attacker to impersonate a Crowd user in REST reques...

CWE-8632017

CVE-2018-7366

MEDIUM
CVSS:6.8(Medium)

ZTE ZXV10 B860AV2.1 product ChinaMobile branch with the ICNT versions up to V1.3.3, the BESTV versions up to V1.2.2, the WASU versions up to V1.1.7 and the MGTV versions up to V1.4.6 have an authentic...

CWE-8632018

CVE-2018-7925

MEDIUM
CVSS:6.8(Medium)

The radio module of some Huawei smartphones Emily-AL00A The versions before 8.1.0.171(C00) have a lock-screen bypass vulnerability. An unauthenticated attacker could start third-part input method APP ...

CWE-8632018