HIGH

GHSA-7rhv-xm4q-wh42

Erxes Incorrect Access Control vulnerability

Quick fix

GHSA-7rhv-xm4q-wh42 — erxes: upgrade to the fixed version with the command below.

npm install erxes@1.6.1

Details

Erxes <1.6.1 is vulnerable to Incorrect Access Control. An attacker can bypass authentication by providing a "User" HTTP header that contains any user, allowing them to talk to any GraphQL endpoint.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/erxes

Introduced in: 0Fixed in: 1.6.1

Fixnpm install erxes@1.6.1

References

https://nvd.nist.gov/vuln/detail/CVE-2024-57190[ADVISORY]
https://github.com/erxes/erxes/commit/4ed2ca797241d2ba0c9083feeadd9755c1310ce8[WEB]
https://github.com/erxes/erxes[PACKAGE]
https://www.sonarsource.com/blog/micro-services-major-headaches-detecting-vulnerabilities-in-erxes-microservices[WEB]