CVE-2017-18924: Code Injection in oauth2-server
Summary
CVE-2017-18924: Code Injection in oauth2-server. Affects oauth2-server versions < 3.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
oauth2-server (aka node-oauth2-server) is an npm package that implements OAuth 2.0 without PKCE. It provides functionality for handling OAuth 2.0 authorization flows. However, versions up to 3.1.1 are vulnerable to code injection, which allows unauthorized access to sensitive information. This vulnerability is similar to CVE-2020-7692.
Vulnerability Detail
The vulnerability in oauth2-server allows for authorization code injection. This means that an attacker can inject malicious code into the authorization code flow, bypassing the intended security measures. This can lead to unauthorized access to protected resources and potential data breaches. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the package to a fixed version as soon as possible to mitigate the risk of code injection.
Conclusion
In conclusion, oauth2-server is vulnerable to code injection, which can result in unauthorized access to sensitive information. It is essential to update the package to a fixed version to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oauth2-server →
FAQ
oauth2-server is an npm package that implements OAuth 2.0 without PKCE. It provides functionality for handling OAuth 2.0 authorization flows.
Code injection is a security vulnerability where an attacker can inject malicious code into a system, bypassing intended security measures.
This vulnerability can lead to unauthorized access to protected resources and potential data breaches.
Yes, it is recommended to update oauth2-server to a version that includes the fix for this issue.
There is no known workaround for this vulnerability. It is crucial to update the package to a fixed version as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for oauth2-server.
