Description
An issue was discovered in NPM’s package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as “secret”.
Recommendation
Update the @evershop/evershop package to the latest compatible version. Followings are version details:
- Affected version(s): < 1.0.0-rc.9
- Patched version(s): 1.0.0-rc.9
References
- GHSA-32r3-57hp-cgfw
- advisory.checkmarx.net
- devhub.checkmarx.com
- CVE-2023-46943
- CWE-284
- CWE-798
- CAPEC-310
- OWASP 2021-A1
- OWASP 2021-A6
- OWASP 2021-A7
Related Issues
- EverShop is vulnerable to Unauthorized Order Information Access (IDOR) - CVE-2025-12919
- evershop allows unauthenticated attackers to exhaust application server's resources via "GET /images" API - CVE-2025-67419
- evershop allows unauthenticated attackers to force server to initiate HTTP request via "GET /images" API - CVE-2025-67427
- Directory Traversal in evershop - @evershop/evershop - GHSA-4wrm-qmq2-5fjx - CVE-2023-46493
You might also like:
- Tags:
- npm
- @evershop/evershop
Anything's wrong? Let us know Last updated on November 18, 2024