Vulnerability · Published Apr 16, 2021 · Assigned by GitHub_M

CVE-2021-29452Any logged in user could edit any other logged in user.

High 8.1

In plain English

A high-severity privilege mismanagement in a12n-server from curveball. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.8%top 43.9% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@curveball/a12n-server	0.18.2	GHSA-8hw9-22v6-9jr9

Affected products (as reported)

Vendor	Product	Versions
curveball	a12n-server	>= 0.18 < 0.18.2

Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9 x_refsource_CONFIRM
https://www.npmjs.com/package/%40curveball/a12n-server x_refsource_MISC