FKIE_CVE-2023-46942

Vulnerability from fkie_nvd - Published: 2024-01-13 02:15 - Updated: 2025-06-03 14:15
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.
References
cve@mitre.orghttps://advisory.checkmarx.net/advisory/CVE-2023-46942
cve@mitre.orghttps://devhub.checkmarx.com/cve-details/CVE-2023-46942/Third Party Advisory
cve@mitre.orghttps://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/Not Applicable
af854a3a-2127-422b-91ae-364da2661108https://advisory.checkmarx.net/advisory/CVE-2023-46942
af854a3a-2127-422b-91ae-364da2661108https://devhub.checkmarx.com/cve-details/CVE-2023-46942/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/Not Applicable
Impacted products
Vendor Product Version
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
evershop evershop 1.0.0
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta:*:*:*:node.js:*:*",
              "matchCriteriaId": "72063F43-AC4F-4522-98FE-D19F226F447E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta1:*:*:*:node.js:*:*",
              "matchCriteriaId": "76A46DCC-B506-4BB0-BBEE-7888E295CCF4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta2:*:*:*:node.js:*:*",
              "matchCriteriaId": "BE498E9E-EE3C-44DC-9606-CEBE443FA9C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta3:*:*:*:node.js:*:*",
              "matchCriteriaId": "BA6D2B18-4489-4622-B9E0-612C64528652",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta4:*:*:*:node.js:*:*",
              "matchCriteriaId": "692BA821-AF49-4317-BD88-9AC950EEFE2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:beta5:*:*:*:node.js:*:*",
              "matchCriteriaId": "D4892919-5F76-4913-948C-9001B4A4CBBF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc1:*:*:*:node.js:*:*",
              "matchCriteriaId": "1B1AB70B-5FE5-422F-AB27-AF8B6F6CCAFC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc2:*:*:*:node.js:*:*",
              "matchCriteriaId": "D76D041A-031D-4117-A582-71EBBD8D57E0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc3:*:*:*:node.js:*:*",
              "matchCriteriaId": "D0E794D9-AC2D-4A42-A55B-70C41F5515B1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc5:*:*:*:node.js:*:*",
              "matchCriteriaId": "4A8E6238-4AE3-46F0-8C7D-14266B554A59",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc6:*:*:*:node.js:*:*",
              "matchCriteriaId": "08D9F6D3-DA15-4A6C-B72E-6E05414615FD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:evershop:evershop:1.0.0:rc7:*:*:*:node.js:*:*",
              "matchCriteriaId": "F9EDF547-27B6-4025-BEA9-7EF9E9A4F3BA",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Lack of authentication in NPM\u0027s package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints."
    },
    {
      "lang": "es",
      "value": "La falta de autenticaci\u00f3n en el paquete @evershop/evershop de NPM antes de la versi\u00f3n 1.0.0-rc.8 permite a atacantes remotos obtener informaci\u00f3n confidencial a trav\u00e9s de una autorizaci\u00f3n inadecuada en los endpoints GraphQL."
    }
  ],
  "id": "CVE-2023-46942",
  "lastModified": "2025-06-03T14:15:30.177",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "nvd@nist.gov",
        "type": "Primary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-01-13T02:15:07.153",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "https://advisory.checkmarx.net/advisory/CVE-2023-46942"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-46942/"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://advisory.checkmarx.net/advisory/CVE-2023-46942"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://devhub.checkmarx.com/cve-details/CVE-2023-46942/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Not Applicable"
      ],
      "url": "https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.