GHSA-7543-mr7h-6v86 Improper Authorization in googleapis
Improper authorization in googleapis library allows requests to use incorrect credentials, potentially bypassing security controls and exposing data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-7543-mr7h-6v86?
GHSA-7543-mr7h-6v86 is a missing authorization vulnerability in googleapis, published on 2 Sep 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Versions of googleapis prior to 39.1.0 are vulnerable to Improper Authorization. Setting credentials to one client may apply to all clients which may cause requests to be sent with the incorrect credentials.
Recommendation
Upgrade to version 39.1.0.
Which versions are affected by GHSA-7543-mr7h-6v86?
2 open source packages ship an affected version, including googleapis.
| Package | Affected | Fixed in |
|---|---|---|
googleapis npm | All versions | 39.1.0 |
googleapis npm | All versions | 39.1.0 |
How do I fix GHSA-7543-mr7h-6v86?
Upgrade googleapis to 39.1.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-7543-mr7h-6v86 being exploited?
There is no known exploitation of GHSA-7543-mr7h-6v86 in the wild and no public exploit code.