Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

CVE-2022-25896— Session Fixation

CVSS 4.8 · Medium EPSS 0.16% · P37
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2022-25896

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Session Fixation
Source: NVD (National Vulnerability Database)
Vulnerability Description
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
passport 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
passport是美国Jared Hanson个人开发者的一个与 Express 兼容的 Node.js 身份验证中间件。 passport 存在安全漏洞，该漏洞源于当用户登录或注销时，会话会重新生成而不是关闭。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
-passport unspecified ~ 0.6.0 -

II. Public POCs for CVE-2022-25896

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2022-25896

请登录查看更多情报信息。

Same Patch Batch · n/a · 2022-07-01 · 54 CVEs total

CVE-2022-259008.1 HIGHCommand Injection
CVE-2022-258987.7 HIGHImproper Verification of Cryptographic Signature
CVE-2022-258766.2 MEDIUMServer-side Request Forgery (SSRF)
CVE-2022-257585.3 MEDIUMRegular Expression Denial of Service (ReDoS)
CVE-2022-32087MariaDB 安全漏洞
CVE-2022-32095Hospital Management System SQL注入漏洞
CVE-2022-32324PDFAlto 缓冲区错误漏洞
CVE-2022-34903GnuPG 注入漏洞
CVE-2022-32411HongCMS 安全漏洞
CVE-2022-32088MariaDB 安全漏洞
CVE-2022-32035Tenda M3 缓冲区错误漏洞
CVE-2022-32086MariaDB 安全漏洞
CVE-2022-32085MariaDB 安全漏洞
CVE-2022-32083MariaDB 安全漏洞
CVE-2022-32030Tenda AX1806 缓冲区错误漏洞
CVE-2022-32031Tenda AX1806 缓冲区错误漏洞
CVE-2022-32032Tenda AX1806 缓冲区错误漏洞
CVE-2022-32033Tenda AX1806 缓冲区错误漏洞
CVE-2022-32034Tenda M3 缓冲区错误漏洞
CVE-2022-32037Tenda M3 缓冲区错误漏洞

Showing top 20 of 54 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: passport
Same vendor: n/a

V. Comments for CVE-2022-25896

No comments yet

Leave a comment