CVE-2022-25896

{"containers": {"cna": {"affected": [{"product": "passport", "vendor": "n/a", "versions": [{"lessThan": "0.6.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "jaredhanson"}], "datePublic": "2022-07-01T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"description": "Session Fixation", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2022-07-01T20:06:04.000Z", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/jaredhanson/passport/pull/900"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"}], "title": "Session Fixation", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "report@snyk.io", "DATE_PUBLIC": "2022-07-01T20:00:14.872984Z", "ID": "CVE-2022-25896", "STATE": "PUBLIC", "TITLE": "Session Fixation"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "passport", "version": {"version_data": [{"version_affected": "<", "version_value": "0.6.0"}]}}]}, "vendor_name": "n/a"}]}}, "credit": [{"lang": "eng", "value": "jaredhanson"}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Session Fixation"}]}]}, "references": {"reference_data": [{"name": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631", "refsource": "MISC", "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"}, {"name": "https://github.com/jaredhanson/passport/pull/900", "refsource": "MISC", "url": "https://github.com/jaredhanson/passport/pull/900"}, {"name": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608", "refsource": "MISC", "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:49:44.156Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jaredhanson/passport/pull/900"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"}]}]}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2022-25896", "datePublished": "2022-07-01T20:06:04.981Z", "dateReserved": "2022-02-24T00:00:00.000Z", "dateUpdated": "2024-09-16T17:54:16.737Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"affected": [{"affectedData": [{"product": "passport", "vendor": "n/a", "versions": [{"lessThan": "0.6.0", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "source": "report@snyk.io"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:passport_project:passport:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "D0AA1812-7B7A-4DF3-9B02-9A44E75B86A6", "versionEndExcluding": "0.6.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed."}, {"lang": "es", "value": "Esto afecta a el paquete passport versiones anteriores a 0.6.0. Cuando un usuario es conectado o desconectado, la sesi\u00f3n es regenerada en lugar de cerrarse"}], "id": "CVE-2022-25896", "lastModified": "2026-06-17T04:34:27.580", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "report@snyk.io", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-07-01T20:15:07.970", "references": [{"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jaredhanson/passport/pull/900"}, {"source": "report@snyk.io", "tags": ["Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/jaredhanson/passport/pull/900"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631"}], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-384"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-governance-policy-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-grafana-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-must-gather-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-operator-bundle-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-prometheus-config-reloader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-prometheus-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "acm-volsync-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "cert-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "cluster-backup-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "config-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "console-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "endpoint-monitoring-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-propagator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-spec-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-status-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "governance-policy-template-sync-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "grafana-dashboard-loader-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "iam-policy-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "insights-client-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "insights-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "klusterlet-addon-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "kube-rbac-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "kube-state-metrics-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "management-ingress-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "memcached-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "memcached-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "metrics-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicloud-integrations-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multiclusterhub-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multiclusterhub-repo-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-observability-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-application-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-channel-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "multicluster-operators-subscription-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "node-exporter-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "observatorium-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "observatorium-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "prometheus-alertmanager-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "prometheus-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "rbac-query-proxy-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "redisgraph-tls-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-aggregator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-api-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-collector-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "search-operator-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "submariner-addon-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "thanos-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}, {"advisory": "RHSA-2022:7313", "cpe": "cpe:/a:redhat:acm:2.6::el8", "package": "thanos-receive-controller-container", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2", "release_date": "2022-11-02T00:00:00Z"}], "bugzilla": {"description": "passport: incorrect session regeneration", "id": "2111862", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2111862"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N", "status": "verified"}, "cwe": "CWE-384", "details": ["This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.", "A misleading session regeneration flaw was found in passport. When a user logs in or logs out, the session is regenerated instead of being closed. This flaw allows an attacker to use a previous session in particular environments."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2022-25896", "package_state": [{"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Affected", "package_name": "rhacm2/search-api-rhel8", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}], "public_date": "2022-07-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-25896\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-25896\nhttps://github.com/jaredhanson/passport/pull/900"], "threat_severity": "Moderate"}

{}