PT-2021-14494 · Npm · Node-Etsy-Client

Boly38 · Published 2021-04-01 · Updated 2022-10-21 · CVE-2021-21421

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions node-etsy-client versions prior to 0.3.0

Description The issue affects applications using node-etsy-client, where client error reports to end users may inadvertently expose API key values.

Recommendations For versions prior to 0.3.0, update to version 0.3.0 or later to resolve the issue. As a temporary workaround for versions prior to 0.3.0, do not report or log Etsy client errors to prevent potential exposure of API key values.

Fix

Information Disclosure

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-200

CWE-209

Related Identifiers

CVE-2021-21421

GHSA-XW22-WV29-3299

Affected Products

Node-Etsy-Client

References · 5

• https://github.com/creharmony/node-etsy-client/commit/b4beb8ef080366c1a87dbf9e163051a446acaa7d · Patch
• https://osv.dev/vulnerability/CVE-2021-21421 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21421 · Security Note
• https://osv.dev/vulnerability/GHSA-xw22-wv29-3299 · Vendor Advisory
• https://github.com/creharmony/node-etsy-client/security/advisories/GHSA-xw22-wv29-3299 · Note