Information Disclosure

2021-11-0803:23:55

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

54.1%

JSON

@sap-cloud-sdk/core is vulnerable to information disclosure. The vulnerability exists because the destination cache does not include the user identity information, allowing an attacker to retrieve the same destination by using other users permissions.

CPENameOperatorVersion
@sap-cloud-sdk/corele1.51.1+20211105173403.0
@sap-cloud-sdk/corele1.51.1+20211105173403.0

CPE	Name	Operator	Version
	@sap-cloud-sdk/core	le	1.51.1+20211105173403.0
	@sap-cloud-sdk/core	le	1.51.1+20211105173403.0

References

github.com/SAP/cloud-sdk-js/pull/1769

github.com/SAP/cloud-sdk-js/pull/1770

github.com/SAP/cloud-sdk-js/pull/1770/commits/ce2b5d405004ddd285ae4357c30244b04115c1a3

github.com/SAP/cloud-sdk-js/security/advisories/GHSA-gp2f-254m-rh32

0.002 Low

EPSS

Percentile

54.1%

JSON

Related for VERACODE:32836