GHSA-7rg2-qxmf-hhx9

Suggest an improvement
Source
https://github.com/advisories/GHSA-7rg2-qxmf-hhx9
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-7rg2-qxmf-hhx9/GHSA-7rg2-qxmf-hhx9.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-7rg2-qxmf-hhx9
Aliases
Related
Published
2021-12-09T19:08:58Z
Modified
2023-11-01T04:56:29.769765Z
Severity
  • 4.6 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Session fixation in express-openid-connect
Details

Overview

Versions 2.3.0 up to and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities.

Am I affected?

You are affected by this vulnerability if you are using express-openid-connect version 2.3.0 up to and including 2.5.1 and use a custom session store.

How to fix that?

Upgrade to version >= 2.5.2.

Will this update impact my users?

The fix provided in patch will not affect your users.

Database specific 
{
    "nvd_published_at": "2021-12-09T16:15:00Z",
    "github_reviewed_at": "2021-12-09T18:09:56Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-384"
    ]
}
References

Affected packages

npm / express-openid-connect

Package

Name
express-openid-connect
View open source insights on deps.dev
Purl
pkg:npm/express-openid-connect

Affected ranges

Type
SEMVER
Events
Introduced
2.3.0
Fixed
2.5.2