high8.1
CVE-2021-29452
Any logged in user could edit any other logged in user.
Impact
### Impact Everyone who is running a12n-server. A new HAL-Form was added to allow editing users. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. ### Patches Patched in v0.18.2
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @curveball/a12n-server | >= 0.18.0, < 0.18.2 | 0.18.2 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Curveballjs | A12n-Server | from 0.18.0 before 0.18.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9
- https://www.npmjs.com/package/%40curveball/a12n-server
- https://github.com/advisories/GHSA-8hw9-22v6-9jr9
- https://www.npmjs.com/package/@curveball/a12n-server
- https://nvd.nist.gov/vuln/detail/CVE-2021-29452