CVE-2021-21421
Assigner: GitHub_M
Published: 2021-04-01T22:10:13
State: PUBLISHED
affected: product: node-etsy-client
vendor: creharmony
versions: status: affected
version: < 0.3.0
descriptions: value: node-etsy-client is a NodeJs Etsy ReST API Client. Applications that are using node-etsy-client and reporting client error to the end user will offer api key value too This is fixed in node-etsy-client v0.3.0 and later.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
version: 3.1
problemTypes: descriptions: cweId: CWE-200
description: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
type: CWE
source: advisory: GHSA-xw22-wv29-3299
discovery: UNKNOWN
title: ApiKey secret could be revelated on network issue