cve.bz

CVE-2019-12300

9.8 criticalEPSS 1.8%

Critical (9.8) in buildbot buildbot. EPSS 1.8% chance of exploitation in the next 30 days. Fixed in buildbot 1.8.2, 2.3.1.

Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user. If an attacker has a token allowing them to read the user details of a victim, they can login as the victim.

Severity

CVSS 3.0

9.8 critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
1.8% chance of exploitation in the next 30 days; higher than 78% of CVEs (scores of 2026-10-31)
CWE
CWE-287
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-g86p-hgx5-2pfhPyPIbuildbot<1.8.21.8.2
GHSA-g86p-hgx5-2pfhPyPIbuildbot>=2.0.0 <2.3.12.3.1
PYSEC-2019-6PyPIbuildbot<1.8.2
>=2.0.1 <2.3.1		1.8.2, 2.3.1

References

Check your stackJSON