CVE-2021-41580

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-41580
The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability

5.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea Patch Third Party Advisory
https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1 Patch Third Party Advisory
https://github.com/jaredhanson/passport-oauth2/pull/144 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:passportjs:passport-oauth2:*:*:*:*:*:node.js:*:*
History

07 Nov 2023, 03:38

Type Values Removed Values Added
Summary ** DISPUTED ** The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability. The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability

12 Jul 2022, 17:42

Type Values Removed Values Added
CWE CWE-287 NVD-CWE-Other

05 Oct 2021, 15:08

Type Values Removed Values Added
CWE CWE-287
CVSS v2 : unknown
v3 : unknown 		v2 : 5.0
v3 : 5.3
References (MISC) https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1 - (MISC) https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1 - Patch, Third Party Advisory
References (MISC) https://github.com/jaredhanson/passport-oauth2/pull/144 - (MISC) https://github.com/jaredhanson/passport-oauth2/pull/144 - Patch, Third Party Advisory
References (MISC) https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea - (MISC) https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea - Patch, Third Party Advisory
CPE cpe:2.3:a:passportjs:passport-oauth2:*:*:*:*:*:node.js:*:*

27 Sep 2021, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2021-09-27 07:15

Updated : 2024-04-11 01:13

NVD link : CVE-2021-41580

Mitre link : CVE-2021-41580

CVE.ORG link : CVE-2021-41580

JSON object : View

Products Affected

passportjs

  • passport-oauth2
CWE
NVD-CWE-Other