CVE-2022-25896 Session Fixation

🗓️ 01 Jul 2022 20:06:04Reported by snykType

Session Fixation in passport package before version 0.6.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Node.js passport is vulnerable to CVE-2022-25896 used in IBM Maximo Application Suite	5 Apr 202318:42	–	ibm
IBM Security Bulletins	Security Bulletin: Netcool Operations Insight v1.6.8 addresses multiple security vulnerabilities.	11 Apr 202311:47	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2022	2 Sep 202219:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities	16 May 202316:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to session hijacking due to Node.js passport module ( CVE-2022-25896 )	8 Aug 202418:23	–	ibm
ATTACKERKB	CVE-2022-25896	1 Jul 202220:00	–	attackerkb
Circl	CVE-2022-25896	2 Jul 202200:40	–	circl
CNNVD	passport 授权问题漏洞	1 Jul 202200:00	–	cnnvd
CVE	CVE-2022-25896	1 Jul 202220:06	–	cve
Debian CVE	CVE-2022-25896	1 Jul 202220:06	–	debiancve

[
  {
    "product": "passport",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "0.6.0",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
github	www.github.com/jaredhanson/passport/pull/900
github	www.github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
snyk	www.snyk.io/vuln/SNYK-JS-PASSPORT-2840631

01 Jul 2022 20:06Current

5.3Medium risk

Vulners AI Score5.3

CVSS 3.14.8

EPSS0.00164