GitHub Advisoryadvisory · npm

GHSA-ggpm-9qfx-mhwg EverShop vulnerable to improper authorization in GraphQL endpoints

HIGH Published 2024-01-13 Modified 2024-07-26 Official page ↗
Aliases
CVE-2023-46942
Ecosystem
npm
Packages
@evershop/evershop
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-285, CWE-287
Reviewed
2024-01-16

Affected packages

• npm @evershop/evershop: < 1.0.0-rc.9 → fixed in 1.0.0-rc.9

Description

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

Related

Alias · CVE (1)

  • CVE-2023-46942 Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness

References