CVE-2021-29452
Last modified
CVE-2021-29452 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. EPSS estimates a 0.78% chance of exploitation in the next 30 days.
Description
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Curveballjs | A12n-Server | >= 0.18.0, < 0.18.2 |
References
- https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9Third Party Advisory
- https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-29452?
How severe is CVE-2021-29452?
How do I fix CVE-2021-29452?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-29446jose-node-cjs-runtime is an npm package which provides a num…5.9
- CVE-2021-29447Wordpress is an open source CMS. A user with the ability to …6.5
- CVE-2021-29448Pi-hole is a Linux network-level advertisement and Internet …8.8
- CVE-2021-29449Pi-hole is a Linux network-level advertisement and Internet …7.8
- CVE-2021-29450Wordpress is an open source CMS. One of the blocks in the Wo…4.3
- CVE-2021-29451Portofino is an open source web development framework. Porto…9.1
- CVE-2021-29453matrix-media-repo is an open-source multi-domain media repos…6.5
- CVE-2021-29454Smarty is a template engine for PHP, facilitating the separa…8.8
- CVE-2021-29455Grassroot Platform is an application to make it faster, chea…5.3
- CVE-2021-29456Authelia is an open-source authentication and authorization …5.4
- CVE-2021-29457Exiv2 is a command-line utility and C++ library for reading,…7.8
- CVE-2021-29458Exiv2 is a command-line utility and C++ library for reading,…5.5
Are you affected by CVE-2021-29452?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST