TI-2023-22611 CVE-2023-42446 · GHSA-3cjh-p6pw-jhv9
Pow Mnesia cache doesn't invalidate all expired keys on startup
Priority LOW 30
Pow is a authentication and user management solution for Phoenix and Plug-based apps.
pow-auth
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9
Exploited now
pow-auth records in CISA KEVNo pow-auth vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
2 records in Pow · all components
TI-2020-04261 CVE-2020-5205 · GHSA-v2wf-c3j6-wpvw
Session fixation attack in Pow (Hex package)
Priority LOW 30
In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database.