What is GHSA-724c-6vrf-99rq?

GHSA-724c-6vrf-99rq is a security advisory published by GitHub Security Advisories with Low severity. Sensitive Data Exposure in loopback

Why does GHSA-724c-6vrf-99rq have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-724c-6vrf-99rq?

GHSA-724c-6vrf-99rq affects 2 products, including: npm/loopback:\u003c= 2.41.0; npm/loopback:\u003e= 3.0.0, \u003c= 3.25.0.

GHSA-724c-6vrf-99rqLowDisclosed before NVD

Sensitive Data Exposure in loopback

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.

Recommendation

If you're using loopback 3.x upgrade to version 3.26.0 or later. If you're using loopback 2.x upgrade to version 2.42.0 or later.

🎯 Affected products2

npm/loopback:<= 2.41.0
npm/loopback:>= 3.0.0, <= 3.25.0

🔗 References (4)

https://github.com/strongloop/loopback/issues/4195
https://loopback.io/doc/en/sec/Security-advisory-06-17-2019.html
https://www.npmjs.com/advisories/915
https://github.com/advisories/GHSA-724c-6vrf-99rq