Lucene search
PRIOn knowledge basePRION:CVE-2021-41246HistoryDec 09, 2021 - 4:15 p.m.
Session fixation
2021-12-0916:15:00
PRIOn knowledge base
www.prio-n.com
3
Express OpenID Connect is express JS middleware implementing sign on for Express web apps using OpenID Connect. Versions before and including 2.5.1 do not regenerate the session id and session cookie when user logs in. This behavior opens up the application to various session fixation vulnerabilities. Versions 2.5.2 contains a patch for this issue.
| CPE | Name | Operator | Version |
|---|---|---|---|
| express_openid_connect | ge | 2.3.0 | |
| express_openid_connect | lt | 2.5.2 |
Related
cve
cve
CVE-2021-41246
2021-12-09 16:15:08
cvelist
cvelist
CVE-2021-41246 Session fixation in express-openid-connect
2021-12-09 15:55:10
github
github
Session fixation in express-openid-connect
2021-12-09 19:08:58
veracode
veracode
Session Fixation
2021-12-10 07:57:44
osv
osv
CVE-2021-41246
2021-12-09 16:15:08
Session fixation in express-openid-connect
2021-12-09 19:08:58
nvd
nvd
CVE-2021-41246
2021-12-09 16:15:08