CVE-2023-46943

Published: Jan 13, 2024Modified: Jun 17, 2026

9.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Exploitability: 3.9 / Impact: 5.2

Source: NVD

Description

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

Affected (12)

Products: Evershop: Evershop

Evershop

1 product

Evershop

Configuration A

12 vulnerable

Vulnerable Software	Affected Versions
Evershop Evershop	Version 1.0.0 beta1
Evershop Evershop	Version 1.0.0 beta2
Evershop Evershop	Version 1.0.0 beta3
Evershop Evershop	Version 1.0.0 beta4
Evershop Evershop	Version 1.0.0 beta5
Evershop Evershop	Version 1.0.0 beta
Evershop Evershop	Version 1.0.0 rc1
Evershop Evershop	Version 1.0.0 rc2
Evershop Evershop	Version 1.0.0 rc3
Evershop Evershop	Version 1.0.0 rc5
Evershop Evershop	Version 1.0.0 rc6
Evershop Evershop	Version 1.0.0 rc7

Related CWEs

CWE-798

Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

References (4)

https://advisory.checkmarx.net/advisory/CVE-2023-46943/

Source: cve@mitre.org

https://devhub.checkmarx.com/cve-details/CVE-2023-46943/

Source: cve@mitre.org

Third Party Advisory

https://advisory.checkmarx.net/advisory/CVE-2023-46943/

Source: af854a3a-2127-422b-91ae-364da2661108

https://devhub.checkmarx.com/cve-details/CVE-2023-46943/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.