GHSA-qrpm-p2h7-hrv2 CVE-2021-23566
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
- Severity
- 5.5 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.44%
- Chance of exploitation in the next 30 days. Higher than 38.26% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- CWE-704 Incorrect Type Conversion or Cast
- Fix
3.1.31- Upgrade nanoid to this version or later
Description
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nanoid npm → 3.1.31
- npm
npm install nanoid@3.1.31- yarn
yarn add nanoid@3.1.31- pnpm
pnpm add nanoid@3.1.31
Severity breakdown
CVSS 3.1 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
CWE-704: Incorrect Type Conversion or Cast
The product does not correctly convert an object, resource, or structure from one type to a different type.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xwg4-73v4-xw9w nanoid: Integer Overflow or Wraparound | High | Also affects nanoid |
| GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size | High | Also affects nanoid |
| GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero | High | Also affects nanoid |
| GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values | Medium | Also affects nanoid |
| GHSA-j7qq-vr8c-xvw3 MLflow CrewAI autologging records LLM provider API keys in logged trace spans | Medium | Same weakness, CWE-200 |
| GHSA-gqh3-7856-rjjg ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure) | Medium | Same weakness, CWE-200 |
| GHSA-rqgm-cfrp-4hx8 ApostropheCMS: Unauthenticated publicApiProjection bypass via search and sort query builders in the public REST API | Medium | Same weakness, CWE-200 |
| GHSA-f66c-mpj2-3r8h ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user | Medium | Same weakness, CWE-200 |
Credits: baptistecs
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor