CVE-2023-46942

moderate-risk

Published 2024-01-13

Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive information via improper authorization in GraphQL endpoints.

Do I need to act?

0.10% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (12)

Evershop

Affected Vendors

Evershop

References (6)

https://advisory.checkmarx.net/advisory/CVE-2023-46942

Third Party Advisory https://devhub.checkmarx.com/cve-details/CVE-2023-46942/

Not Applicable https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/

https://advisory.checkmarx.net/advisory/CVE-2023-46942

Third Party Advisory https://devhub.checkmarx.com/cve-details/CVE-2023-46942/

Not Applicable https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5/

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 0/34 · Minimal

Exposure 17/34 · Moderate