deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41088
Published: 2021-09-23
Description: Elvish is a programming language and interactive shell, combined into one package. In versions prior to 0.14.0 Elvish's web UI backend (started by `elvish -web`) hosts an endpoint that allows executing the code sent from the web UI. The backend does not check the origin of requests correctly. As a result, if the user has the web UI backend open and visits a compromised or malicious website, the website can send arbitrary code to the endpoint in localhost. All Elvish releases from 0.14.0 onward no longer include the the web UI, although it is still possible for the user to build a version from source that includes the web UI. The issue can be patched for previous versions by removing the web UI (found in web, pkg/web or pkg/prog/web, depending on the exact version).
CVSS Score: 8.0 (HIGH)
CWE: CWE-668, CWE-346
References: https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5; https://github.com/elves/elvish/security/advisories/GHSA-fpv6-f8jw-rc3r; https://github.com/elves/elvish/commit/ccc2750037bbbfafe9c1b7a78eadd3bd16e81fe5
CVE: CVE-2021-31923
Published: 2021-09-24
Description: Ping Identity PingAccess before 5.3.3 allows HTTP request smuggling via header manipulation.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-444
References: https://docs.pingidentity.com/bundle/pingaccess-53/page/wco[PII_REDACTED]67.html; https://docs.pingidentity.com/bundle/pingaccess-53/page/wco[PII_REDACTED]67.html
CVE: CVE-2021-41581
Published: 2021-09-24
Description: x509_constraints_parse_mailbox in lib/libcrypto/x509/x509_constraints.c in LibreSSL through 3.4.0 has a stack-based buffer over-read. When the input exceeds DOMAIN_PART_MAX_LEN, the buffer lacks '\0' termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://github.com/libressl-portable/openbsd/issues/126; https://github.com/libressl-portable/openbsd/issues/126
CVE: CVE-2021-41583
Published: 2021-09-24
Description: vpn-user-portal (aka eduVPN or Let's Connect!) before 2.3.14, as packaged for Debian 10, Debian 11, and Fedora, allows remote authenticated users to obtain OS filesystem access, because of the interaction of QR codes with an exec that uses the -r option. This can be leveraged to obtain additional VPN access.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://list.surfnet.nl/pipermail/eduvpn-deploy/2021-September/000352.html; https://github.com/eduvpn/vpn-user-portal/releases; https://list.surfnet.nl/pipermail/eduvpn-deploy/2021-September/000352.html
CVE: CVE-2021-41584
Published: 2021-09-24
Description: Gradle Enterprise before 2021.1.3 can allow unauthorized viewing of a response (information disclosure of possibly sensitive build/configuration details) via a crafted HTTP request with the X-Gradle-Enterprise-Ajax-Request header.
CVSS Score: 7.5 (HIGH)
References: https://security.gradle.com/advisory/2021-02; https://security.gradle.com/advisory/2021-02
CVE: CVE-2021-36749
Published: 2021-09-24
Description: In the Druid ingestion system, the InputSource is used for reading data from a certain data source. However, the HTTP InputSource allows authenticated users to read data from other sources than intended, such as the local file system, with the privileges of the Druid server process. This is not an elevation of privilege when users access Druid directly, since Druid also provides the Local InputSource, which allows the same level of access. But it is problematic when users interact with Druid indirectly through an application that allows users to specify the HTTP InputSource, but not the Local InputSource. In this case, users could bypass the application-level restriction by passing a file URL to the HTTP InputSource. This issue was previously mentioned as being fixed in 0.21.0 as per CVE-2021-26920 but was not fixed in 0.21.0 or 0.21.1.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E; https://lists.apache.org/thread.html/rc9400a70d0ec5cdb8a3486fc5ddb0b5282961c0b63e764abfbcb9f5d%40%3Cdev.druid.apache.org%3E; https://lists.apache.org/thread.html/r304dfe56a5dfe1b2d9166b24d2c74ad1c6730338b20aef77a00ed2be%40%3Cannounce.apache.org%3E
CVE: CVE-2021-40099
Published: 2021-09-24
Description: An issue was discovered in Concrete CMS through 8.5.5. Fetching the update json scheme over HTTP leads to remote code execution.
CVSS Score: 7.2 (HIGH)
References: https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes; https://hackerone.com/reports/982130; https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE: CVE-2021-40100
Published: 2021-09-24
Description: An issue was discovered in Concrete CMS through 8.5.5. Stored XSS can occur in Conversations when the Active Conversation Editor is set to Rich Text.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes; https://hackerone.com/reports/616770; https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE: CVE-2021-40102
Published: 2021-09-24
Description: An issue was discovered in Concrete CMS through 8.5.5. Arbitrary File deletion can occur via PHAR deserialization in is_dir (PHP Object Injection associated with the __wakeup magic method).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-502
References: https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes; https://hackerone.com/reports/921288; https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
CVE: CVE-2021-41586
Published: 2021-09-24
Description: In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially reset the system user password.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://security.gradle.com/advisory/2021-05; https://security.gradle.com/advisory/2021-05
CVE: CVE-2021-41587
Published: 2021-09-24
Description: In Gradle Enterprise before 2021.1.3, an attacker with the ability to perform SSRF attacks can potentially discover credentials for other resources.
CVSS Score: 7.5 (HIGH)
CWE: CWE-918
References: https://security.gradle.com/advisory/2021-04; https://security.gradle.com/advisory/2021-04
CVE: CVE-2021-41588
Published: 2021-09-24
Description: In Gradle Enterprise before 2021.1.3, a crafted request can trigger deserialization of arbitrary unsafe Java objects. The attacker must have the encryption and signing keys.
CVSS Score: 8.1 (HIGH)
CWE: CWE-502
References: https://security.gradle.com/advisory/2021-03; https://security.gradle.com/advisory/2021-03
CVE: CVE-2021-28130
Published: 2021-09-24
Description: Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_svc.exe) bypasses firewall filters.
CVSS Score: 7.8 (HIGH)
CWE: CWE-427
References: https://habr.com/ru/company/pm/blog/579328/; https://news.drweb.ru/show/?i=14180&lng=ru; https://habr.com/ru/company/pm/blog/579328/
CVE: CVE-2021-40309
Published: 2021-09-24
Description: A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-89
References: https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md; https://github.com/OS4ED/openSIS-Classic; https://www.exploit-db.com/exploits/50249
CVE: CVE-2021-40310
Published: 2021-09-24
Description: OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://github.com/MiSERYYYYY/Vulnerability-Reports-and-Disclosures/blob/main/OpenSIS-Community-8.0.md; https://github.com/OS4ED/openSIS-Classic; https://www.youtube.com/watch?v=aPKPUDmmYpc
CVE: CVE-2021-22868
Published: 2021-09-24
Description: A path traversal vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. User-controlled configuration options used by GitHub Pages were not sufficiently restricted and made it possible to read files on the GitHub Enterprise Server instance. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.1.8 and was fixed in 3.1.8, 3.0.16, and 2.22.22. This vulnerability was reported via the GitHub Bug Bounty program. This is the result of an incomplete fix for CVE-2021-22867.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-77, CWE-22
References: https://docs.github.com/en/enterprise-server%402.22/admin/release-notes#2.22.22; https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16; https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.8
CVE: CVE-2021-22869
Published: 2021-09-24
Description: An improper access control vulnerability in GitHub Enterprise Server allowed a workflow job to execute in a self-hosted runner group it should not have had access to. This affects customers using self-hosted runner groups for access control. A repository with access to one enterprise runner group could access all of the enterprise runner groups within the organization because of improper authentication checks during the request. This could cause code to be run unintentionally by the incorrect runner group. This vulnerability affected GitHub Enterprise Server versions from 3.0.0 to 3.0.15 and 3.1.0 to 3.1.7 and was fixed in 3.0.16 and 3.1.8 releases.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-668, CWE-287
References: https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16; https://docs.github.com/en/enterprise-server%403.1/admin/release-notes#3.1.8; https://docs.github.com/en/enterprise-server%403.0/admin/release-notes#3.0.16
CVE: CVE-2021-35313
Published: 2021-09-24
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
CVE: CVE-2021-2464
Published: 2021-09-24
Description: Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Linux executes to compromise Oracle Linux. Successful attacks of this vulnerability can result in takeover of Oracle Linux. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
CVSS Score: 7.8 (HIGH)
References: https://linux.oracle.com/errata/ELSA-2021-9444.html; https://www.oracle.com/security-alerts/cpuapr2022.html; https://linux.oracle.com/errata/ELSA-2021-9444.html
CVE: CVE-2021-39246
Published: 2021-09-24
Description: Tor Browser through 10.5.6 and 11.x through 11.0a4 allows a correlation attack that can compromise the privacy of visits to v2 onion addresses. Exact timestamps of these onion-service visits are logged locally, and an attacker might be able to compare them to timestamp data collected by the destination server (or collected by a rogue site within the Tor network).
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-532
References: https://github.com/sickcodes/security/blob/master/advisories/SICK-2021-111.md; https://gitlab.torproject.org/tpo/core/tor/-/commit/80c404c4b79f3bcba3fc4585d4c62a62a04f3ed9; https://gitlab.torproject.org/tpo/core/tor/-/merge_requests/434
CVE: CVE-2021-41503
Published: 2021-09-24
Description: DCS-5000L v1.05 and DCS-932L v2.17 and older are affecged by Incorrect Acess Control. The use of the basic authentication for the devices command interface allows attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.0 (HIGH)
CWE: CWE-287, CWE-287
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247; https://www.dlink.com/en/security-bulletin/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247
CVE: CVE-2021-41504
Published: 2021-09-24
Description: An Elevated Privileges issue exists in D-Link DCS-5000L v1.05 and DCS-932L v2.17 and older. The use of the digest-authentication for the devices command interface may allow further attack vectors that may compromise the cameras configuration and allow malicious users on the LAN to access the device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
CVSS Score: 8.0 (HIGH)
References: https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247; https://www.dlink.com/en/security-bulletin/; https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10247
CVE: CVE-2016-6555
Published: 2021-09-24
Description: OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP trap supplied data. By creating a malicious SNMP trap, an attacker can store an XSS payload which will trigger when a user of the web UI views the events list page. This issue was fixed in version 18.0.2, released on September 20, 2016.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms/pull/1019; https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/; https://github.com/OpenNMS/opennms/pull/1019
CVE: CVE-2016-6556
Published: 2021-09-24
Description: OpenNMS version 18.0.1 and prior are vulnerable to a stored XSS issue due to insufficient filtering of SNMP agent supplied data. By creating a malicious SNMP 'sysName' or 'sysContact' response, an attacker can store an XSS payload which will trigger when a user of the web UI views the data. This issue was fixed in version 18.0.2, released on September 20, 2016.
CVSS Score: 7.1 (HIGH)
CWE: CWE-79, CWE-79
References: https://github.com/OpenNMS/opennms/pull/1019; https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/; https://github.com/OpenNMS/opennms/pull/1019
CVE: CVE-2021-40654
Published: 2021-09-24
Description: An information disclosure issue exist in D-LINK-DIR-615 B2 2.01mt. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-863
References: https://github.com/Ilovewomen/D-LINK-DIR-615; https://www.dlink.com/en/security-bulletin/; https://github.com/Ilovewomen/D-LINK-DIR-615
CVE: CVE-2021-40655
Published: 2021-09-24
Description: An informtion disclosure issue exists in D-LINK-DIR-605 B2 Firmware Version : 2.01MT. An attacker can obtain a user name and password by forging a post request to the / getcfg.php page
CVSS Score: 7.5 (HIGH)
CWE: CWE-863, CWE-863
References: https://github.com/Ilovewomen/D-LINK-DIR-605/; https://www.dlink.com/en/security-bulletin/; https://github.com/Ilovewomen/D-LINK-DIR-605/
CVE: CVE-2020-20508
Published: 2021-09-24
Description: Shopkit v2.7 contains a reflective cross-site scripting (XSS) vulnerability in the /account/register component, which allows attackers to hijack user credentials via a crafted payload in the E-Mail text field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://github.com/samnabi/shopkit/issues/223; https://github.com/samnabi/shopkit/issues/223
CVE: CVE-2020-20514
Published: 2021-09-24
Description: A Cross-Site Request Forgery (CSRF) in Maccms v10 via admin.php/admin/admin/del/ids/<id>.html allows authenticated attackers to delete all users.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://github.com/magicblack/maccms10/issues/76; https://github.com/magicblack/maccms10/issues/76
CVE: CVE-2021-21742
Published: 2021-09-25
Description: There is an information leak vulnerability in the message service app of a ZTE mobile phone. Due to improper parameter settings, attackers could use this vulnerability to obtain some sensitive information of users by accessing specific pages.
CVSS Score: 5.5 (MEDIUM)
References: https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019084; https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019084
CVE: CVE-2021-3830
Published: 2021-09-26
Description: btcpayserver is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/btcpayserver/btcpayserver/commit/fc4e47cec608cc3dba24b19d0145ac69320b975e; https://huntr.dev/bounties/0fcdee5f-1f07-47ce-b650-ea8b4a7d35d8; https://github.com/btcpayserver/btcpayserver/commit/fc4e47cec608cc3dba24b19d0145ac69320b975e
CVE: CVE-2021-41617
Published: 2021-09-26
Description: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.
CVSS Score: 7.0 (HIGH)
References: https://bugzilla.suse.com/show_bug.cgi?id=1190975; https://lists.debian.org/debian-lts-announce/2023/12/msg00017.html; https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6XJIONMHMKZDTMH6BQR5TNLF2WDCGWED/
CVE: CVE-2021-34348
Published: 2021-09-27
Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-21-35; https://www.qnap.com/en/security-advisory/qsa-21-35
CVE: CVE-2021-34349
Published: 2021-09-27
Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later
CVSS Score: 7.2 (HIGH)
CWE: CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-21-35; https://www.qnap.com/en/security-advisory/qsa-21-35
CVE: CVE-2021-34351
Published: 2021-09-27
Description: A command injection vulnerability has been reported to affect QNAP device running QVR. If exploited, this vulnerability could allow remote attackers to run arbitrary commands. We have already fixed this vulnerability in the following versions of QVR: QVR 5.1.5 build 20210803 and later
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-77
References: https://www.qnap.com/en/security-advisory/qsa-21-35; https://www.qnap.com/en/security-advisory/qsa-21-35
CVE: CVE-2021-31604
Published: 2021-09-27
Description: furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/164281/OpenVPN-Monitor-1.1.3-Cross-Site-Request-Forgery.html; https://github.com/furlongm/openvpn-monitor/releases; http://packetstormsecurity.com/files/164281/OpenVPN-Monitor-1.1.3-Cross-Site-Request-Forgery.html
CVE: CVE-2021-31605
Published: 2021-09-27
Description: furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket. This can shut down the server via signal%20SIGTERM.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78
References: http://packetstormsecurity.com/files/164278/OpenVPN-Monitor-1.1.3-Command-Injection.html; https://github.com/furlongm/openvpn-monitor/releases; http://packetstormsecurity.com/files/164278/OpenVPN-Monitor-1.1.3-Command-Injection.html
CVE: CVE-2021-31606
Published: 2021-09-27
Description: furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.
CVSS Score: 7.5 (HIGH)
CWE: CWE-287
References: http://packetstormsecurity.com/files/164274/OpenVPN-Monitor-1.1.3-Authorization-Bypass-Denial-Of-Service.html; https://github.com/furlongm/openvpn-monitor/commit/ddb9d31ef0ec56f578bdacf99ebe9d68455ed8ca; https://github.com/furlongm/openvpn-monitor/releases
CVE: CVE-2021-38299
Published: 2021-09-27
Description: Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-287
References: https://github.com/web-auth/webauthn-framework/releases; https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework/; https://github.com/web-auth/webauthn-framework/releases
CVE: CVE-2021-40349
Published: 2021-09-27
Description: e7d Speed Test (aka speedtest) 0.5.3 allows a path-traversal attack that results in information disclosure via the "GET /.." substring.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-22
References: https://github.com/e7d/speedtest/releases; https://old.reddit.com/r/HackingTechniques/comments/poc55t/directory_traversal_bypass_on_e7d_speedtest/; https://github.com/e7d/speedtest/releases
CVE: CVE-2021-40981
Published: 2021-09-27
Description: ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GamingCenterLib directory.
CVSS Score: 7.3 (HIGH)
CWE: CWE-427
References: https://aptw.tf/2021/09/24/armoury-crate-privesc.html; https://aptw.tf/2021/09/24/armoury-crate-privesc.html
CVE: CVE-2021-41329
Published: 2021-09-27
Description: Datalust Seq before 2021.2.6259 allows users (with view filters applied to their accounts) to see query results not constrained by their view filter. This information exposure, caused by an internal cache key collision, occurs when the user's view filter includes an array or IN clause, and when another user has recently executed an identical query differing only by the array elements.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-682
References: https://blog.datalust.co; https://github.com/datalust/seq-tickets/issues/1322; https://blog.datalust.co
CVE: CVE-2021-41385
Published: 2021-09-27
Description: The third party intelligence connector in Securonix SNYPR 6.3.1 Build 184295_0302 allows an authenticated user to obtain access to server configuration details via SSRF.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-918
References: https://documentation.securonix.com/onlinedoc/Content/Product%20Security/Content/Product%20Security/Authenticated%20SSRF%20in%20TPI.htm; https://documentation.securonix.com/onlinedoc/Content/Product%20Security/Content/Product%20Security/Authenticated%20SSRF%20in%20TPI.htm
CVE: CVE-2021-41580
Published: 2021-09-27
Description: The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability
CVSS Score: 5.3 (MEDIUM)
References: https://github.com/jaredhanson/passport-oauth2/commit/8e3bcdff145a2219033bd782fc517229fe3e05ea; https://github.com/jaredhanson/passport-oauth2/compare/v1.6.0...v1.6.1; https://github.com/jaredhanson/passport-oauth2/pull/144