PT-2024-13390 · Npm · @Evershop/Evershop

Published 2024-01-12 · Updated 2024-07-25 · CVE-2023-46942

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions @evershop/evershop versions prior to 1.0.0-rc.8

Description The issue is related to a lack of authentication in the @evershop/evershop package, which allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

Recommendations For versions prior to 1.0.0-rc.8, update to version 1.0.0-rc.8 or later to resolve the issue. As a temporary workaround, consider restricting access to the GraphQL endpoints until a patch is applied.

Fix

Improper Authorization

Improper Authentication

Weakness Enumeration

CWE-285

CWE-287

Related Identifiers

CVE-2023-46942

GHSA-GGPM-9QFX-MHWG

Affected Products

@Evershop/Evershop

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2023-46942 · Security Note
• https://osv.dev/vulnerability/GHSA-ggpm-9qfx-mhwg · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-46942 · Vendor Advisory
• https://github.com/evershopcommerce/evershop · Note
• https://github.com/evershopcommerce/evershop/commit/6e16f046e0b95efa16431a5ea41c22215273e9dd · Note
• https://devhub.checkmarx.com/cve-details/CVE-2023-46942 · Note
• https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5 · Note
• https://t.me/cvenotify/67353 · Telegram Post
• https://twitter.com/CVEnew/status/1745998019839787516 · Twitter Post
• https://t.me/cvenotify/87460 · Telegram Post
• https://advisory.checkmarx.net/advisory/CVE-2023-46942 · Note