Add CVE-2018-1000211 for Doorkeeper

[f3ndot]

Merge pending the release of 5.0.0.rc2 and 4.4.0: doorkeeper-gem/doorkeeper#1120 (comment) they are now released

[phillmv]

Dope, thanks.

@f3ndot how serious would say this vuln is?

[f3ndot]

@phillmv I think it's debatable/matter of perspective on the severity of this vuln.

I liken it to the logout button not working on a website, so that's pretty severe in terms of things not working as expected. However, in order to take advantage, the access and/or refresh tokens must be compromised-- an already difficult feat.

Ignoring the ease of which an attacker can get into the appropriate pre-conditions to leverage the attack, it's medium/high because the entire feature is, in fact, non-functional for all public apps.