UnratedNuGetPublished
Low severity vulnerability that affects Gw2Sharp
GHSA-4vr3-9v7h-5f8v
- Affected
- NuGet gw2sharp < 0.3.1
- Fixed in
- 0.3.1· Vendor fix available
- Issue
- Leaking cached authenticated requests Impact If you've been using one MemoryCacheMethod object in multiple instances of Gw2WebApiClient and are requesting authenticated endpoints with different access tokens, then you are likely to run into this bug. When using an instance of MemoryCacheMethod and using it with multiple instances of Gw2WebApiClient, there's a possibility that cached authenticated responses are leaking to another request to the same endpoint, but with a different Guild Wars 2 access token. The latter request wouldn't start however, and would return the first cached response immediately. This means that the second response (or later responses) may contain the same data as the first response, therefore leaking data from another authenticated endpoint. The occurence of this is limited however. The Guild Wars 2 API doesn't use the Expires header on most (if not all) authenticated endpoints. This header is checked when caching responses. If this header isn't available, the…
Recommended action: Upgrade to 0.3.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.