CVE Vulnerability

CVE-2021-41580

** DISPUTED ** The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1 Patch Third Party Advisory
https://github.com/jaredhanson/passport-oauth2/pull/144 Patch Third Party Advisory
https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea Patch Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:passportjs:passport-oauth2:*:*:*:*:*:node.js:*:*
Information

Published : 2021-09-27 07:15

Updated : 2022-07-12 05:42

NVD link : CVE-2021-41580

Mitre link : CVE-2021-41580

Products Affected
No products.
CWE
NVD-CWE-Other