{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.41.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "loopback"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.42.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 3.25.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "loopback"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.26.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:40:25Z",
    "nvd_published_at": null,
    "severity": "LOW"
  },
  "details": "Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for credential theft.\n\n\n## Recommendation\n\nIf you\u0027re using `loopback` 3.x upgrade to version 3.26.0 or later.\nIf you\u0027re using `loopback` 2.x upgrade to version 2.42.0 or later.",
  "id": "GHSA-724c-6vrf-99rq",
  "modified": "2021-09-27T22:31:27Z",
  "published": "2020-09-02T21:49:48Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/strongloop/loopback/issues/4195"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/strongloop/loopback"
    },
    {
      "type": "WEB",
      "url": "https://loopback.io/doc/en/sec/Security-advisory-06-17-2019.html"
    },
    {
      "type": "WEB",
      "url": "https://www.npmjs.com/advisories/915"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [],
  "summary": "Sensitive Data Exposure in loopback"
}