Lucene search
GoogleOSV:CVE-2021-29452HistoryApr 16, 2021 - 10:15 p.m.
CVE-2021-29452
2021-04-1622:15:14
Google
osv.dev
5
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.
| CPE | Name | Operator | Version |
|---|---|---|---|
| a12n-server | eq | 0.18.0 | |
| a12n-server | eq | 0.18.1 |
Related
cvelist
cvelist
CVE-2021-29452 Any logged in user could edit any other logged in user.
2021-04-16 21:35:15
github
github
Any logged in user could edit any other logged in user.
2021-04-19 15:14:33
nvd
nvd
CVE-2021-29452
2021-04-16 22:15:14
cve
cve
CVE-2021-29452
2021-04-16 22:15:14
veracode
veracode
Insecure Access Controls
2021-04-19 06:09:58
prion
prion
Authentication flaw
2021-04-16 22:15:00
osv
osv
Any logged in user could edit any other logged in user.
2021-04-19 15:14:33