GitHub Advisoryadvisory · npm

GHSA-hx78-272p-mqqh Authorization Bypass in graphql-shield

LOW Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
graphql-shield
Severity
Low
Weaknesses
CWE-285
Reviewed
2020-08-31

Affected packages

• npm graphql-shield: < 6.0.6 → fixed in 6.0.6

Description

Versions of `graphql-shield` prior to 6.0.6 are vulnerable to an Authorization Bypass. The rule caching option `no_cache` relies on keys generated by cryptographically insecure functions, which may cause rules to be incorrectly cached. This allows attackers to access information they should not have access to in case of a key collision. Recommendation Upgrade to version 6.0.6 or later.

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References