HIGH
GHSA-r2vw-jgq9-jqx2
Improper Authorization in @sap-cloud-sdk/core
Quick fix
GHSA-r2vw-jgq9-jqx2 — @sap-cloud-sdk/core: upgrade to the fixed version with the command below.
npm install @sap-cloud-sdk/core@1.21.2Details
Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs. The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.
## Recommendation
Upgrade to version 1.21.2 or later.
Are you affected?
Enter the version of the package you're using.
Affected packages
npm/@sap-cloud-sdk/core
Introduced in:
1.19.0Fixed in: 1.21.2Fix
npm install @sap-cloud-sdk/core@1.21.2