Description
This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.
Remediation
References
https://github.com/jaredhanson/passport/commit/7e9b9cf4d7be02428e963fc729496a45baeea608
https://github.com/jaredhanson/passport/pull/900
https://snyk.io/vuln/SNYK-JS-PASSPORT-2840631
Related Vulnerabilities
CVE-2023-25570 Vulnerability in maven package com.ctrip.framework.apollo:apollo
CVE-2019-10792 Vulnerability in npm package bodymen
CVE-2022-36886 Vulnerability in maven package org.jenkins-ci.plugins:external-monitor-job
CVE-2023-24620 Vulnerability in maven package com.esotericsoftware.yamlbeans:yamlbeans
CVE-2023-26474 Vulnerability in maven package org.xwiki.platform:xwiki-platform-legacy-oldcore