HIGH7.4
GHSA-32r3-57hp-cgfw
EverShop at risk to unauthorized access via weak HMAC secret
Quick fix
GHSA-32r3-57hp-cgfw — @evershop/evershop: upgrade to the fixed version with the command below.
npm install @evershop/evershop@1.0.0-rc.9Details
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@evershop/evershop
Introduced in:
0Fixed in: 1.0.0-rc.9Fix
npm install @evershop/evershop@1.0.0-rc.9References
- https://nvd.nist.gov/vuln/detail/CVE-2023-46943[ADVISORY]
- https://github.com/evershopcommerce/evershop/commit/96d9ca3e024e0b63c538911e4a914df3d287cc9f[WEB]
- https://advisory.checkmarx.net/advisory/CVE-2023-46943[WEB]
- https://devhub.checkmarx.com/cve-details/CVE-2023-46943[WEB]
- https://github.com/evershopcommerce/evershop[PACKAGE]