Description
In Pow (Hex package) before 1.0.16, the use of Plug.Session in Pow.Plug.Session is susceptible to session fixation attacks if a persistent session store is used for Plug.Session, such as Redis or a database. Cookie store, which is used in most Phoenix apps, doesn't have this vulnerability.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| danschultzer | Pow | < 1.0.16 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Hex | pow | < 1.0.16 | 1.0.16 | GHSA-v2wf-c3j6-wpvw |