Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThodzktMjJ2Ni05anI5

Any logged in user could edit any other logged in user.

Impact

Everyone who is running a12n-server.

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

Patches

Patched in v0.18.2

Permalink: https://github.com/advisories/GHSA-8hw9-22v6-9jr9
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLThodzktMjJ2Ni05anI5
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 3 years ago
Updated: over 1 year ago

CVSS Score: 8.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Identifiers: GHSA-8hw9-22v6-9jr9, CVE-2021-29452
References:

• https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9
• https://www.npmjs.com/package/@curveball/a12n-server
• https://nvd.nist.gov/vuln/detail/CVE-2021-29452
• https://github.com/advisories/GHSA-8hw9-22v6-9jr9

Repository: https://github.com/curveball/a12n-server
Blast Radius: 1.0

Affected Packages