Lucene search

GitHub Advisory DatabaseGHSA-JQH7-W5PR-CR56

HistoryMay 17, 2021 - 9:01 p.m.

Cross-site scripting in @shopify/koa-shopify-auth

2021-05-1721:01:22

CWE-79

GitHub Advisory Database

github.com

cross-site scripting

vulnerability

koa-shopify-auth

v3.1.61

v3.1.62

js payloads

enable cookies

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.7%

JSON

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enable_cookies endpoint.

Affected configurations

Vulners

Node

shopifykoa-shopify-authRange≤3.1.62

References

github.com/advisories/GHSA-jqh7-w5pr-cr56

github.com/Shopify/quilt/pull/1455

hackerone.com/reports/881409

nvd.nist.gov/vuln/detail/CVE-2020-8176

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS3

6.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

40.7%

JSON

Related for GHSA-JQH7-W5PR-CR56