CVE-2017-18924
Summary
| CVE | CVE-2017-18924 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2020-10-04 05:15:00 UTC |
|---|
| Updated | 2023-11-07 02:41:00 UTC |
|---|
| Description | ** DISPUTED ** oauth2-server (aka node-oauth2-server) through 3.1.1 implements OAuth 2.0 without PKCE. It does not prevent authorization code injection. This is similar to CVE-2020-7692. NOTE: the vendor states 'As RFC7636 is an extension, I think the claim in the Readme of "RFC 6749 compliant" is valid and not misleading and I also therefore wouldn't describe this as a "vulnerability" with the library per se.' |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| RFC 7636 - Proof Key for Code Exchange by OAuth Public Clients |
MISC |
tools.ietf.org |
Third Party Advisory |
| PKCE by visvk · Pull Request #452 · oauthjs/node-oauth2-server · GitHub |
MISC |
github.com |
Patch, Third Party Advisory |
| draft-ietf-oauth-security-topics-15 - OAuth 2.0 Security Best Current Practice |
MISC |
tools.ietf.org |
Exploit, Third Party Advisory |
| Multiple Security Vulnerabilities in Auth and Token Endpoint · Issue #637 · oauthjs/node-oauth2-server · GitHub |
MISC |
github.com |
Exploit, Third Party Advisory |
| Missing the Point in Securing OAuth 2.0 | by John Tucker | codeburst |
MISC |
codeburst.io |
Third Party Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 982722 Nodejs (npm) Security Update for oauth2-server (GHSA-2fw4-mgq9-39cx)
