Information Exposure Through Sent Data Affecting @perfood/couch-auth package, versions <0.20.1
Threat Intelligence
EPSS
0.09% (41st
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-PERFOODCOUCHAUTH-6143587
- published 4 Jan 2024
- disclosed 3 Jan 2024
- credit Florian Walter
Introduced: 3 Jan 2024
CVE-2023-39655 Open this link in a new tabHow to fix?
Upgrade @perfood/couch-auth to version 0.20.1 or higher.
Overview
@perfood/couch-auth is an Easy and secure authentication for CouchDB/Cloudant. Based on SuperLogin, updated and rewritten in Typescript.
Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the password reset feature. An attacker can intercept password reset tokens and take over user accounts by sending a specially crafted host header in the forgot password request, which causes the password reset link to be sent to an attacker-controlled server.
References
CVSS Scores
version 3.1