GHSA-8wgc-jjvv-cv6v

Source

https://github.com/advisories/GHSA-8wgc-jjvv-cv6v

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8wgc-jjvv-cv6v/GHSA-8wgc-jjvv-cv6v.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-8wgc-jjvv-cv6v

Downstream

CLSA-2026-1788862742

Published

2020-09-02T15:54:52Z

Modified

2021-09-27T15:44:08Z

Summary

Improper Authorization in loopback

Details

Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.

Recommendation

For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later

Database specific

{
    "cwe_ids":  [
        "CWE-285"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2020-08-31T18:35:10Z",
    "nvd_published_at":  null,
    "severity":  "HIGH"
}

References

Affected packages

npm / loopback

Package

Name: loopback; View open source insights on deps.dev
Purl: pkg:npm/loopback

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.40.0

Database specific

last_known_affected_version_range

"<= 2.39.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/09/GHSA-8wgc-jjvv-cv6v/GHSA-8wgc-jjvv-cv6v.json"