GitHub Advisoryadvisory · npm

GHSA-32r3-57hp-cgfw EverShop at risk to unauthorized access via weak HMAC secret

CRITICAL Published 2024-01-13 Modified 2024-11-18 Official page ↗
Aliases
CVE-2023-46943
Ecosystem
npm
Packages
@evershop/evershop
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-284, CWE-798
Reviewed
2024-01-16

Affected packages

• npm @evershop/evershop: < 1.0.0-rc.9 → fixed in 1.0.0-rc.9

Description

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

Related

Alias · CVE (1)

  • CVE-2023-46943 An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. vulnerability

Weakness · CWE (2)

  • CWE-284 Improper Access Control weakness
  • CWE-798 Use of Hard-coded Credentials weakness

References