GitHub Advisoryadvisory · npm

GHSA-xw22-wv29-3299 ApiKey secret could be revelated on network issue

HIGH Published 2021-04-06 Modified 2021-04-02 Official page ↗
Aliases
CVE-2021-21421
Ecosystem
npm
Packages
node-etsy-client
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weaknesses
CWE-200, CWE-209
Reviewed
2021-04-02

Affected packages

• npm node-etsy-client: < 0.3.0 → fixed in 0.3.0

Description

Impact _What kind of vulnerability is it? Who is impacted?_ Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too Patches _Has the problem been patched? What versions should users upgrade to?_ creharmony/node-etsy-client#18 fixes this issue. This is fixed in node-etsy-client v0.3.0 and later. Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ Do not report or log etsy client error if you are using version <= v0.2.0 Update your version of node-etsy-client References _Are there any links users can visit to find out more?_ • https://github.com/creharmony/node-etsy-client/issues/17 : On connect error secret appears in error #17 For more information If you have any questions or comments about this advisory: • Open an issue in github.com/creharmony/node-etsy-client/issues

Related

Alias · CVE (1)

  • CVE-2021-21421 node-etsy-client is a NodeJs Etsy ReST API Client. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-209 Generation of Error Message Containing Sensitive Information weakness

References