GHSA-8hw9-22v6-9jr9

Source

https://github.com/advisories/GHSA-8hw9-22v6-9jr9

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-8hw9-22v6-9jr9/GHSA-8hw9-22v6-9jr9.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8hw9-22v6-9jr9

Aliases

CVE-2021-29452

Published

2021-04-19T15:14:33Z

Modified

2026-07-08T06:28:55Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N CVSS Calculator

Summary

Any logged in user could edit any other logged in user.

Details

Impact

Everyone who is running a12n-server.

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

Patches

Patched in v0.18.2

Database specific

{
    "cwe_ids":  [
        "CWE-269",
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2021-04-16T23:04:15Z",
    "nvd_published_at":  "2021-04-16T22:15:00Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / @curveball/a12n-server

Package

Name: @curveball/a12n-server; View open source insights on deps.dev
Purl: pkg:npm/%40curveball/a12n-server

Affected ranges

Type: SEMVER
Events: Introduced

0.18.0

Fixed

0.18.2

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-8hw9-22v6-9jr9/GHSA-8hw9-22v6-9jr9.json"