9.1

CVE-2023-46943

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Evershop ≫ Evershop Version1.0.0 Updatebeta SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updatebeta1 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updatebeta2 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updatebeta3 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updatebeta4 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updatebeta5 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc1 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc2 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc3 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc5 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc6 SwPlatformnode.js
Evershop ≫ Evershop Version1.0.0 Updaterc7 SwPlatformnode.js
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.09% 0.253
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
134c704f-9b21-4f2e-91b3-4a467353bcc0 9.1 3.9 5.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.