Homepage
About Snyk

Improper Authorization Affecting @sap-cloud-sdk/core package, versions >=1.19.0 <1.21.2

Severity

 Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-SAPCLOUDSDKCORE-572711
  • published 18 Jun 2020
  • disclosed 17 Jun 2020
  • credit Unknown
Report a new vulnerability Found a mistake?

Introduced: 17 Jun 2020

CVE NOT AVAILABLE CWE-287 Open this link in a new tab

How to fix?

Upgrade @sap-cloud-sdk/core to version 1.21.2 or higher.

Overview

@sap-cloud-sdk/core is a This package contains the core functionality of the SAP Cloud SDK as well as the Cloud Platform abstractions.

Affected versions of this package are vulnerable to Improper Authorization. The verifyJwt() function does not properly validate the URL from where the public verification key for the JWT can be downloaded. Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.

References

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
7.4 high
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    None
  • User Interaction (UI)
    None
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    High
  • Integrity (I)
    High
  • Availability (A)
    None