GHSA-2fw4-mgq9-39cx

    Dashboard / Vulnerabilities / GHSA-2fw4-mgq9-39cx

    GHSA-2fw4-mgq9-39cx

    Published: 22 Apr 2021Last Modified: 8 Nov 2023

    Summary: Code Injection in oauth2-server

    Details: "oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.'"

    References: https://nvd.nist.gov/vuln/detail/CVE-2017-18924, https://github.com/oauthjs/node-oauth2-server/issues/637, https://github.com/oauthjs/node-oauth2-server/pull/452, https://codeburst.io/missing-the-point-in-securing-oauth-2-0-83968708b467, https://tools.ietf.org/html/draft-ietf-oauth-security-topics-15, https://tools.ietf.org/html/rfc7636

    Affected packages

    Package

    Name: oauth2-server

    Purl: pkg:npm/oauth2-server

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-2fw4-mgq9-39cx | CVE-DB