GitHub Advisoryadvisory · npm

GHSA-r2vw-jgq9-jqx2 Improper Authorization in @sap-cloud-sdk/core

HIGH Published 2020-09-03 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
@sap-cloud-sdk/core
Severity
High
Weaknesses
CWE-285
Reviewed
2020-08-31

Affected packages

• npm @sap-cloud-sdk/core: >= 1.19.0, < 1.21.2 → fixed in 1.21.2

Description

Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs. The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT. Recommendation Upgrade to version 1.21.2 or later.

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References