Description

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Remediation

References

https://github.com/ai/nanoid/pull/328

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550

https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444

https://snyk.io/vuln/SNYK-JS-NANOID-2332193

https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575

Related Vulnerabilities

CVE-2021-23358 Vulnerability in npm package underscore

CVE-2022-21213 Vulnerability in npm package mout

CVE-2023-22465 Vulnerability in maven package org.http4s:http4s-core_3

CVE-2021-39236 Vulnerability in maven package org.apache.ozone:ozone-main

CVE-2021-43838 Vulnerability in npm package jsx-slack

Severity

Medium

Classification

CWE-704 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Exploit Issue Tracking Patch Third Party Advisory