CVE-2021-41580: Medium severity IBM Cloud Pak for Business Automation vulnerability
DISPUTED The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.
Other sources
Node.js passport-oauth2 module could allow a remote attacker to obtain sensitive information, caused by the mishandling of error condition. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain access token information, and use this information to launch further attacks against the affected system.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-41580.
What is the severity of CVE-2021-41580?
The severity of CVE-2021-41580 is medium with a CVSS score of 5.3.
How does CVE-2021-41580 impact Node.js passport-oauth2 module?
CVE-2021-41580 can allow a remote attacker to obtain sensitive information by exploiting a mishandling of error condition in the Node.js passport-oauth2 module.
What is the affected software for CVE-2021-41580?
The affected software is IBM Cloud Pak for Business Automation, versions V23.0.1-IF002, V21.0.3-IF024, V22.0.2-IF006 and later fixes, V21.0.1-IF007 and later fixes, V20.0.1-V20.0.3 and later fixes, V19.0.1-V19.0.3 and later fixes, V18.0.0-V18.0.2 and later fixes.
How can an attacker exploit CVE-2021-41580?
An attacker can exploit CVE-2021-41580 by sending a specially-crafted request to obtain access token information and potentially launch further attacks.