CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-46943

CVSS 9.1v3.1pub. 2024-01-13upd. 2024-11-21

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens (JWTs), allowing them access to important information and actions within the application.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

  • Evershop

    APP
    Evershop
    1.0.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
CWE
References

Related vulnerabilities

CVE-2026-28213CRITICAL9.8PL ✓ten sam produkt

EverShop: token resetowania hasła ujawniany w odpowiedzi API

CVE-2026-25993CRITICAL9.3PL ✓ten sam produkt

Second-order SQL injection w EverShop podczas obsługi kategorii

CVE-2023-46498CRITICAL9.8PL ✓ten sam produkt

RCE i ujawnienie danych w EverShop NPM przez plik route.json

CVE-2025-67419HIGH7.5ten sam produkt

A Denial of Service (DoS) vulnerability in evershop 2.1.0 and prior allows unauthenticated attackers to exhaus...

CVE-2025-65844HIGH7.5ten sam produkt

EverShop 2.0.1 allows a remote unauthenticated attacker to upload arbitrary files and create directories via t...