scratchoauth2 vulnerabilities and fixes

Recent CVEs affecting scratchoauth2, with upgrade or downgrade steps. 4 tracked.

scratchoauth2 has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2022-02-15. Highest priority: CVE-2021-46250 (score 56/100).

• CVE-2021-46251 MEDIUM 6.1 UPGRADE A reflected cross-site scripting (XSS) in ScratchOAuth2 before commit 1603f04e44ef67dde6ccffe866d2dca16defb293
• CVE-2021-46250 CRITICAL 10.0 UPGRADE An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allow
• CVE-2021-46249 MEDIUM 6.5 UPGRADE An authorization bypass exploited by a user-controlled key in SpecificApps REST API in ScratchOAuth2 before co
• CVE-2021-29437 HIGH 8.0 UPGRADE ScratchOAuth2 is an Oauth implementation for Scratch

FAQ

How do I fix scratchoauth2 vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is scratchoauth2 being exploited right now?

None of the tracked scratchoauth2 CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which scratchoauth2 CVE should I patch first?

CVE-2021-46250 currently ranks highest (56/100): An issue in SOA2Login::commented of ScratchOAuth2 before commit a91879bd58fa83b09283c0708a1864cdf067c64a allow.

RSS feed for scratchoauth2 · ← Back to latest CVEs