CVE-2023-46943: Critical severity evershop vulnerability
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.9. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
Other sources
An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-46943?
The severity of CVE-2023-46943 is considered high due to the risk of attackers exploiting a predictable HMAC secret to create valid JSON Web Tokens.
How do I fix CVE-2023-46943?
To fix CVE-2023-46943, upgrade the @evershop/evershop package to version 1.0.0-rc.9 or later.
Which versions are affected by CVE-2023-46943?
CVE-2023-46943 affects @evershop/evershop versions prior to 1.0.0-rc.9, including versions 1.0.0-beta and 1.0.0-rc up to rc7.
What impact does CVE-2023-46943 have on security?
CVE-2023-46943 can lead to unauthorized access as attackers can forge valid JWTs due to the weak HMAC secret.
Is CVE-2023-46943 a client-side or server-side vulnerability?
CVE-2023-46943 is primarily a server-side vulnerability affecting the backend authentication of applications using the @evershop/evershop package.