What is GHSA-ggpm-9qfx-mhwg?

GHSA-ggpm-9qfx-mhwg is a security advisory published by GitHub Security Advisories with High severity. EverShop vulnerable to improper authorization in GraphQL endpoints

Which CVE IDs does GHSA-ggpm-9qfx-mhwg cover?

GHSA-ggpm-9qfx-mhwg covers the following CVE IDs: CVE-2023-46942. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-ggpm-9qfx-mhwg?

GHSA-ggpm-9qfx-mhwg has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-ggpm-9qfx-mhwg?

GHSA-ggpm-9qfx-mhwg affects 1 product, including: npm/@evershop/evershop:\u003c 1.0.0-rc.9.

GHSA-ggpm-9qfx-mhwgHighCVSS 7.5

EverShop vulnerable to improper authorization in GraphQL endpoints

Vendor

GitHub Security Advisories

Published

January 13, 2024

Last Modified

July 26, 2024

🔗 CVE IDs covered (1)

CVE-2023-46942 →

📋 Description

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.9, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

🎯 Affected products1

npm/@evershop/evershop:< 1.0.0-rc.9

🔗 References (6)

https://nvd.nist.gov/vuln/detail/CVE-2023-46942
https://github.com/evershopcommerce/evershop/commit/6e16f046e0b95efa16431a5ea41c22215273e9dd
https://advisory.checkmarx.net/advisory/CVE-2023-46942
https://devhub.checkmarx.com/cve-details/CVE-2023-46942
https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5
https://github.com/advisories/GHSA-ggpm-9qfx-mhwg