Information Exposure
CVE-2021-23566

4MEDIUM

Key Information:

Vendor

Nanoid Project

Status
Nanoid
Vendor
CVE Published:
14 January 2022

What is CVE-2021-23566?

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Affected Version(s)

nanoid < 3.1.31

References

https://snyk.io/vuln/SNYK-JS-NANOID-2332193
x_refsource_MISC
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550
x_refsource_MISC
https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876...
x_refsource_MISC

CVSS V3.1

Score:
4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Artyom Arutyunyan
JSON
.