CVE-2021-23566 Information Exposure

2022-01-1420:05:21

snyk

www.cve.org

information exposure

package nanoid

vulnerable version

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P

AI Score

Confidence

High

EPSS

0.001

Percentile

29.4%

JSON

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

CNA Affected

[
  {
    "product": "nanoid",
    "vendor": "n/a",
    "versions": [
      {
        "lessThan": "3.1.31",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]