← Back

CVE-2023-46942

nvd nist
Published: Jan 13, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

Affected (12)

Products: Evershop: Evershop
Evershop
1 product
Evershop
Configuration A
12 vulnerable
Vulnerable SoftwareAffected Versions
Evershop
Evershop
Version 1.0.0 beta1
Evershop
Version 1.0.0 beta2
Evershop
Version 1.0.0 beta3
Evershop
Version 1.0.0 beta4
Evershop
Version 1.0.0 beta5
Evershop
Version 1.0.0 beta
Evershop
Version 1.0.0 rc1
Evershop
Version 1.0.0 rc2
Evershop
Version 1.0.0 rc3
Evershop
Version 1.0.0 rc5
Evershop
Version 1.0.0 rc6
Evershop
Version 1.0.0 rc7

Related CWEs

CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (6)

Source: cve@mitre.org
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Not Applicable
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Not Applicable

Timeline

No history available yet.