{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.39.2"
      },
      "package": {
        "ecosystem": "npm",
        "name": "loopback"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.40.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.21.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "loopback"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.22.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-285"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:35:10Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "Vulnerable versions of `loopback` may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target\u0027s `userId`. This will allow the attacker to access the user\u0027s data and their privileges.\n\n\n## Recommendation\n\nFor loopback 2.x, upgrade to version 2.40.0 or later\nFor loopback 3.x, upgrade to version 3.22.0 or later",
  "id": "GHSA-8wgc-jjvv-cv6v",
  "modified": "2021-09-27T15:44:08Z",
  "published": "2020-09-02T15:54:52Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://github.com/strongloop/loopback"
    },
    {
      "type": "WEB",
      "url": "https://loopback.io/doc/en/lb2/Security-advisory-08-08-2018.html]"
    },
    {
      "type": "WEB",
      "url": "https://loopback.io/doc/en/lb3/Security-advisory-08-08-2018.html]"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/771"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Improper Authorization in loopback"
}