GHSA-4j6x-w426-6rc6
Suggest an improvement- Source
- https://github.com/advisories/GHSA-4j6x-w426-6rc6
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2019/11/GHSA-4j6x-w426-6rc6/GHSA-4j6x-w426-6rc6.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-4j6x-w426-6rc6
- Published
- 2019-11-08T17:31:17Z
- Modified
- 2020-06-16T20:58:26Z
- Summary
- Default Express middleware security check is ignored in production
- Details
-
Default Express middleware security check is ignored in production
Impact
All Cube.js deployments that use affected versions of
@cubejs-backend/api-gatewaywith default express authentication middleware in production environment are affected.Patches
@cubejs-backend/api-gateway@0.11.17
Workarounds
Override default authentication express middleware: https://cube.dev/docs/@cubejs-backend-server-core#options-reference-check-auth-middleware
For more information
If you have any questions or comments about this advisory:
- Open an issue in https://github.com/cube-js/cube.js/issues
- Reach out us in community Slack: https://slack.cube.dev/
- Database specific
{ "cwe_ids": [], "github_reviewed": true, "github_reviewed_at": "2020-06-16T20:58:26Z", "nvd_published_at": null, "severity": "HIGH" }- References
Affected packages
npm / @cubejs-backend/api-gateway
Package
- Name
- @cubejs-backend/api-gateway
- View open source insights on deps.dev
- Purl
- pkg:npm/%40cubejs-backend/api-gateway