SNYK-JS-PASSPORT-2840631

SNYK-JS-PASSPORT-2840631 PUBLISHED CVSS 4.800000190734863 MEDIUM

## Overview [passport](https://www.npmjs.org/package/passport) is a Simple, unobtrusive authentication for Node.js. Affected versions of this package are vulnerable to Session Fixation. When a user logs in or logs out, the session is regenerated instead of being closed. ## Remediation Upgrade `passport` to version 0.6.0 or higher. ## References - [GitHub Commit](https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608) - [GitHub PR](https://github.com/jaredhanson/passport/pull/900)

Risk Scores

CVSS 3.1

4.800000190734863

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L

Affected Products

Vendor	Product	Versions
		0

Timeline

May 20, 2022 CVE Updated
Jun 29, 2022 CVE Published

References

https://security.snyk.io/vuln/SNYK-JS-PASSPORT-2840631 advisory
https://www.npmjs.org/package/passport technical
https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608 patch
https://github.com/jaredhanson/passport/pull/900 patch

Open in Interactive Console →