github - ghsa-v923-w3x8-wh69

ghsa-v923-w3x8-wh69

Vulnerability from github

Published

2022-07-02 00:00

Modified

2023-09-11 16:22

Severity ?

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Summary

Passport vulnerable to session regeneration when a users logs in or out

Details

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

Show details on source website

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "passport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.6.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-25896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-384"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-07-06T21:09:15Z",
    "nvd_published_at": "2022-07-01T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.",
  "id": "GHSA-v923-w3x8-wh69",
  "modified": "2023-09-11T16:22:17Z",
  "published": "2022-07-02T00:00:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25896"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaredhanson/passport/pull/900"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/jaredhanson/passport"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Passport vulnerable to session regeneration when a users logs in or out"
}

CVE-2022-25896 (GCVE-0-2022-25896)

Vulnerability from cvelistv5

Published

2022-07-01 20:06

Modified

2024-09-16 17:54

Severity ?

4.8 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

CWE

Session Fixation

Summary

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

References

URL

Tags

	https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631	x_refsource_MISC
	https://github.com/jaredhanson/passport/pull/900	x_refsource_MISC
	https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	passport	Version: unspecified < 0.6.0

Show details on NVD website

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T04:49:44.156Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/jaredhanson/passport/pull/900"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "passport",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "0.6.0",
              "status": "affected",
              "version": "unspecified",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "jaredhanson"
        }
      ],
      "datePublic": "2022-07-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Session Fixation",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-01T20:06:04",
        "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
        "shortName": "snyk"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jaredhanson/passport/pull/900"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"
        }
      ],
      "title": "Session Fixation",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "report@snyk.io",
          "DATE_PUBLIC": "2022-07-01T20:00:14.872984Z",
          "ID": "CVE-2022-25896",
          "STATE": "PUBLIC",
          "TITLE": "Session Fixation"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "passport",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "\u003c",
                            "version_value": "0.6.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "credit": [
          {
            "lang": "eng",
            "value": "jaredhanson"
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Session Fixation"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631",
              "refsource": "MISC",
              "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"
            },
            {
              "name": "https://github.com/jaredhanson/passport/pull/900",
              "refsource": "MISC",
              "url": "https://github.com/jaredhanson/passport/pull/900"
            },
            {
              "name": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608",
              "refsource": "MISC",
              "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
    "assignerShortName": "snyk",
    "cveId": "CVE-2022-25896",
    "datePublished": "2022-07-01T20:06:04.981270Z",
    "dateReserved": "2022-02-24T00:00:00",
    "dateUpdated": "2024-09-16T17:54:16.737Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Log in or create an account to share your comment.

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.