What is GHSA-r2vw-jgq9-jqx2?

GHSA-r2vw-jgq9-jqx2 is a security advisory published by GitHub Security Advisories with High severity. Improper Authorization in @sap-cloud-sdk/core

Why does GHSA-r2vw-jgq9-jqx2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-r2vw-jgq9-jqx2?

GHSA-r2vw-jgq9-jqx2 affects 1 product, including: npm/@sap-cloud-sdk/core:\u003e= 1.19.0, \u003c 1.21.2.

GHSA-r2vw-jgq9-jqx2HighDisclosed before NVD

Improper Authorization in @sap-cloud-sdk/core

Vendor

GitHub Security Advisories

Published

September 3, 2020

Last Modified

January 9, 2023

📋 Description

Affected versions of @sap-cloud-sdk/core do not properly validate JWTs. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.

Recommendation

Upgrade to version 1.21.2 or later.

🎯 Affected products1

npm/@sap-cloud-sdk/core:>= 1.19.0, < 1.21.2

🔗 References (2)

https://www.npmjs.com/advisories/1540
https://github.com/advisories/GHSA-r2vw-jgq9-jqx2