Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS03cmcyLXF4bWYtaGh4Oc0ahA
Session fixation in express-openid-connect
Overview
Versions 2.3.0
up to and including 2.5.1
do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.
Am I affected?
You are affected by this vulnerability if you are using express-openid-connect
version 2.3.0
up to and including 2.5.1
and use a custom session store.
How to fix that?
Upgrade to version >= 2.5.2
.
Will this update impact my users?
The fix provided in patch will not affect your users.
Permalink: https://github.com/advisories/GHSA-7rg2-qxmf-hhx9JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS03cmcyLXF4bWYtaGh4Oc0ahA
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: over 1 year ago
CVSS Score: 4.6
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Identifiers: GHSA-7rg2-qxmf-hhx9, CVE-2021-41246
References:
- https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9
- https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f
- https://nvd.nist.gov/vuln/detail/CVE-2021-41246
- https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2
- https://github.com/advisories/GHSA-7rg2-qxmf-hhx9
Blast Radius: 13.4
Affected Packages
npm:express-openid-connect
Dependent packages: 21Dependent repositories: 807
Downloads: 249,407 last month
Affected Version Ranges: >= 2.3.0, < 2.5.2
Fixed in: 2.5.2
All affected versions: 2.3.0, 2.3.1, 2.4.0, 2.5.0, 2.5.1
All unaffected versions: 0.0.1, 0.0.2, 0.0.3, 0.1.0, 0.2.0, 0.3.0, 0.4.0, 0.5.0, 0.6.0, 0.7.0, 0.8.0, 0.8.1, 1.0.0, 1.0.1, 1.0.2, 2.0.0, 2.1.0, 2.2.0, 2.2.1, 2.5.2, 2.6.0, 2.7.0, 2.7.1, 2.7.2, 2.7.3, 2.8.0, 2.9.0, 2.10.0, 2.11.0, 2.12.0, 2.12.1, 2.13.0, 2.14.0, 2.15.0, 2.16.0, 2.17.0, 2.17.1