Authentication Bypass

Affecting loopback package, versions <3.16.2

Overview

loopback is an Open Source Framework for Node.js.

Affected versions of the package are vulnerable to Authentication Bypass. It allowes users to change Admin's password by using their regular access token in case they have the same id and the same password.

Remediation

Upgrade loopback to version 3.16.2 or higher.

References

Do your applications use this vulnerable package?

CVSS Score

5.3
medium severity
  • Attack Vector
    Network
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    None
  • Scope
    Unchanged
  • Confidentiality
    None
  • Integrity
    Low
  • Availability
    None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Credit
Unknown
CWE
CWE-592
Snyk ID
npm:loopback:20171027
Disclosed
26 Oct, 2017
Published
06 Mar, 2018