Lucene search
UnknownNODEJS:151HistoryOct 27, 2016 - 4:03 p.m.
Authentication Bypass
2016-10-2716:03:12
Unknown
www.npmjs.com
46
0.006 Low
EPSS
Percentile
78.5%
Overview
Affected versions of passport-azure-ad do not recognize the validateIssuer setting, which allows remote attackers to bypass authentication via a crafted token.
Recommendation
Version 1.x: Update to version 1.4.6 or later.
Version 2.x: Update to version 2.0.1 or later.
References
| CPE | Name | Operator | Version |
|---|---|---|---|
| passport-azure-ad | ge | 1.0.0 < 1.4.6 || 2.0.0 |
Related
github
github
Authentication Bypass in passport-azure-ad
2018-07-26 15:53:31
osv
osv
Authentication Bypass in passport-azure-ad
2018-07-26 15:53:31
cve
cve
CVE-2016-7191
2016-09-28 20:59:00
symantec
symantec
prion
prion
Authentication flaw
2016-09-28 20:59:00
cvelist
cvelist
CVE-2016-7191
2016-09-28 20:00:00
nvd
nvd
CVE-2016-7191
2016-09-28 20:59:00
mscve
mscve
Win32k Elevation of Privilege Vulnerability
2016-10-11 07:00:00
mskb
mskb
MS16-123: Security update for kernel-mode drivers: October 11, 2016
2016-10-11 00:00:00
nessus
nessus
MS16-123: Security Update for Windows Kernel-Mode Drivers (3192892)
2016-10-12 00:00:00