CVE-2023-46943: EverShop at risk to unauthorized access via weak HMAC secret
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Published Jan 13, 2024 · Updated Nov 18, 2024
Affected packages
@evershop/evershop
- Ecosystem
- npm
- Affected
- < 1.0.0-rc.9
- Fixed in
- 1.0.0-rc.9
- Check
npm ls @evershop/evershop
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology