HIGH8.1

GHSA-8hw9-22v6-9jr9

Any logged in user could edit any other logged in user.

Quick fix

GHSA-8hw9-22v6-9jr9 — @curveball/a12n-server: upgrade to the fixed version with the command below.

npm install @curveball/a12n-server@0.18.2

Details

### Impact Everyone who is running a12n-server.

A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change.

### Patches Patched in v0.18.2

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/@curveball/a12n-server

Introduced in: 0.18.0Fixed in: 0.18.2

Fixnpm install @curveball/a12n-server@0.18.2

References

https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2021-29452[ADVISORY]
https://www.npmjs.com/package/@curveball/a12n-server[WEB]