CVE-2021-46249

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-46249
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46249.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-46249
Published
2022-02-15T23:15:07.917Z
Modified
2026-03-14T11:18:24.132336Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
Summary
[none]
Details

An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before commit d856dc704b2504cd3b92cf089fdd366dd40775d6 allows app owners to set flags that indicate whether an app is verified on their own apps.

References

Affected packages

Git / github.com/scratchverifier/scratchoauth2

Affected ranges

Type
GIT
Repo
https://github.com/scratchverifier/scratchoauth2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d856dc704b2504cd3b92cf089fdd366dd40775d6
Type
GIT
Repo
https://github.com/scratchverifier/scratchoauth2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d856dc704b2504cd3b92cf089fdd366dd40775d6

Database specific

unresolved_ranges 
[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2021-04-12"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "ScratchOAuth2"
            }
        ]
    }
]
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-46249.json"