GitHub Advisoryadvisory · npm

GHSA-724c-6vrf-99rq Sensitive Data Exposure in loopback

LOW Published 2020-09-02 Modified 2021-09-27 Official page ↗
Ecosystem
npm
Packages
loopback
Severity
Low
Weaknesses
CWE-200
Reviewed
2020-08-31

Affected packages

• npm loopback: < 2.42.0 → fixed in 2.42.0 • npm loopback: >= 3.0.0, < 3.26.0 → fixed in 3.26.0

Description

Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft. Recommendation If you're using `loopback` 3.x upgrade to version 3.26.0 or later. If you're using `loopback` 2.x upgrade to version 2.42.0 or later.

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References