{"id":"GHSA-r2vw-jgq9-jqx2","aliases":[],"status":"published","title":"Improper Authorization in @sap-cloud-sdk/core","description":"Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.\n\n\n## Recommendation\n\nUpgrade to version 1.21.2 or later.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2020-09-03T15:54:11Z","modified":"2023-01-09T05:03:53Z","fixes":[{"ecosystem":"npm","package":"@sap-cloud-sdk/core","fixed_in":["1.21.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sap-cloud-sdk/core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.19.0"},{"fixed":"1.21.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@sap-cloud-sdk/core","ranges":[{"type":"SEMVER","events":[{"introduced":"1.19.0"},{"fixed":"1.21.2"}]}]}],"references":[{"url":"https://www.npmjs.com/advisories/1540","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r2vw-jgq9-jqx2"}],"sources":{"ghsa":[{"id":"GHSA-r2vw-jgq9-jqx2","title":"Improper Authorization in @sap-cloud-sdk/core","description":"Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.\n\n\n## Recommendation\n\nUpgrade to version 1.21.2 or later.","status":"published","published":"2020-09-03T15:54:11Z","modified":"2023-01-09T05:03:53Z","cwes":["CWE-285"],"updated_at":"2026-11-02T14:36:07.581563Z"}],"osv":[{"id":"GHSA-r2vw-jgq9-jqx2","title":"Improper Authorization in @sap-cloud-sdk/core","description":"Affected versions of `@sap-cloud-sdk/core` do not properly validate JWTs.  The `verifyJwt()` function does not properly validate the URL from where the public verification key for the JWT can be downloaded.  Any URL was trusted which makes it possible to provide a URL belonging to a manipulated JWT.\n\n\n## Recommendation\n\nUpgrade to version 1.21.2 or later.","status":"published","published":"2020-09-03T15:54:11Z","modified":"2020-08-31T19:02:48Z","cwes":["CWE-285"],"updated_at":"2026-11-02T15:46:55.122811Z"}]}}