PT-2021-23210 · Unknown · Express Openid Connect

Audrey Budryte · Published 2021-12-09 · Updated 2021-12-14 · CVE-2021-41246

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Express OpenID Connect versions 2.3.0 through 2.5.1

Description The issue arises from the failure to regenerate the session id and session cookie when a user logs in, making the application susceptible to session fixation vulnerabilities. This behavior affects versions prior to the patch release.

Recommendations For versions 2.3.0 through 2.5.1, upgrade to version 2.5.2 or later to resolve the issue.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2021-41246

GHSA-7RG2-QXMF-HHX9

Affected Products

Express Openid Connect

References · 8

• https://github.com/auth0/express-openid-connect/commit/5ab67ff2bd84f76674066b5e129b43ab5f2f430f · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41246 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41246 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7rg2-qxmf-hhx9 · Vendor Advisory
• https://github.com/auth0/express-openid-connect/security/advisories/GHSA-7rg2-qxmf-hhx9 · Note
• https://github.com/auth0/express-openid-connect/releases/tag/v2.5.2 · Note
• https://github.com/auth0/express-openid-connect · Note
• https://t.me/cibsecurity/33685 · Telegram Post