CVE-2024-11023
1 advisory.
npm/firebase CVE-2024-11023: medium 5.3
Firebase JavaScript SDK allows attackers to manipulate the "_authTokenSyncURL" to point to their own server
Action: Upgrade firebase to 10.9.0 or later.
npm i firebase@10.9.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.9.0 | - |
Fixed versions
| 10.9.0 |
Sources
- osv: GHSA-3wf4-68gx-mph8
- https://nvd.nist.gov/vuln/detail/CVE-2024-11023
- https://github.com/firebase/firebase-js-sdk/pull/8056
- https://github.com/firebase/firebase-js-sdk/commit/245dd26e19b6c16aca7e1b7e597ed5784c2984ba
- https://firebase.google.com/support/release-notes/js#version_1090_-_march_14_2024
- https://github.com/firebase/firebase-js-sdk
CVE-2024-11023 · published · modified · JSON