CVE-2022-25896: Session Fixation

July 1, 2022 (updated July 13, 2022)

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

References

github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
github.com/jaredhanson/passport/pull/900
nvd.nist.gov/vuln/detail/CVE-2022-25896
snyk.io/vuln/SNYK-JS-PASSPORT-2840631

Code Behaviors & Features

Detect and mitigate CVE-2022-25896 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →