Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Versions of loopback prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft. Recommendation If you're using loopback 3.x upgrade to version 3.26.0 or later. If you're using loopback 2.x upgrade to version 2.42.0 or later.
Recommended action: Upgrade to 3.26.0 or 2.42.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges. Recommendation For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later
Recommended action: Upgrade to 3.22.0 or 2.40.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.