CVE-2021-23566 : The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Published 2022-01-14 20:15:10

Updated 2022-07-12 17:42:04

Source Snyk

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2021-23566

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 28 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-23566

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None
4.0	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N	2.5	1.4	Snyk
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

References for CVE-2021-23566

https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550

Information Exposure in org.webjars.npm:nanoid | CVE-2021-23566 | Snyk
Exploit;Third Party Advisory
https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444

nanoid-collision.js · GitHub
Exploit;Third Party Advisory
https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575

fix collision by proxy number (#328) · ai/nanoid@2b7bd93 · GitHub
Patch;Third Party Advisory
https://snyk.io/vuln/SNYK-JS-NANOID-2332193

Information Exposure in nanoid | CVE-2021-23566 | Snyk
Exploit;Third Party Advisory
https://github.com/ai/nanoid/pull/328

fix collision by proxy number by artalar · Pull Request #328 · ai/nanoid · GitHub
Exploit;Issue Tracking;Patch;Third Party Advisory

Products affected by CVE-2021-23566

Nanoid Project » Nanoid » For Node.js
Versions from including (>=) 3.0.0 and before (<) 3.1.31
cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:*
Matching versions

Vulnerability Details : CVE-2021-23566

Exploit prediction scoring system (EPSS) score for CVE-2021-23566

CVSS scores for CVE-2021-23566

CWE ids for CVE-2021-23566

References for CVE-2021-23566

Products affected by CVE-2021-23566