What is GHSA-8wgc-jjvv-cv6v?

GHSA-8wgc-jjvv-cv6v is a security advisory published by GitHub Security Advisories with High severity. Improper Authorization in loopback

Why does GHSA-8wgc-jjvv-cv6v have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-8wgc-jjvv-cv6v?

GHSA-8wgc-jjvv-cv6v affects 2 products, including: npm/loopback:\u003c= 2.39.2; npm/loopback:\u003e= 3.0.0, \u003c= 3.21.0.

GHSA-8wgc-jjvv-cv6vHighDisclosed before NVD

Improper Authorization in loopback

Vendor

GitHub Security Advisories

Published

September 2, 2020

Last Modified

January 9, 2023

📋 Description

Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.

Recommendation

For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later

🎯 Affected products2

npm/loopback:<= 2.39.2
npm/loopback:>= 3.0.0, <= 3.21.0

🔗 References (5)

https://loopback.io/doc/en/lb2/Security-advisory-08-08-2018.html]
https://loopback.io/doc/en/lb3/Security-advisory-08-08-2018.html]
https://www.npmjs.com/advisories/771
https://github.com/strongloop/loopback
https://github.com/advisories/GHSA-8wgc-jjvv-cv6v