{"action":"Upgrade @evershop/evershop to 1.0.0-rc.9 or later.","affected":[{"fixed":"1.0.0-rc.9","introduced":"0"}],"component":"@evershop/evershop","cve_ids":["CVE-2023-46942"],"ecosystem":"npm","epss":0.00732,"exploited":false,"fixed_versions":["1.0.0-rc.9"],"ghsa_id":"GHSA-ggpm-9qfx-mhwg","id":"tcs_01M5KFRNV8578T1WC4RFVN4750","modified_at":"2024-07-26T21:37:07Z","published_at":"2024-01-13T03:30:17Z","references":["https://osv.dev/vulnerability/GHSA-ggpm-9qfx-mhwg","https://nvd.nist.gov/vuln/detail/CVE-2023-46942","https://github.com/evershopcommerce/evershop/commit/6e16f046e0b95efa16431a5ea41c22215273e9dd","https://advisory.checkmarx.net/advisory/CVE-2023-46942","https://devhub.checkmarx.com/cve-details/CVE-2023-46942","https://devhub.checkmarx.com/cve-details/Cx00cea2d5-d2c5","https://github.com/evershopcommerce/evershop"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-ggpm-9qfx-mhwg","url":"https://osv.dev/vulnerability/GHSA-ggpm-9qfx-mhwg"}],"summary":"EverShop vulnerable to improper authorization in GraphQL endpoints"}