Coder Social home page Coder Social logo

sharonkoch / wiki_demo Goto Github PK

View Code? Open in Web Editor NEW

This project forked from requarks/wiki

1.0 0.0 0.0 30.12 MB

Wiki.js | A modern and powerful wiki app built on Node.js

Home Page: https://js.wiki

License: GNU Affero General Public License v3.0

Shell 1.67% JavaScript 42.13% Go 0.19% CSS 0.17% HTML 2.00% Vue 47.69% Dockerfile 0.16% Pug 0.78% SCSS 5.04% Mustache 0.16%

wiki_demo's Introduction

Wiki.js

Release License Standard - JavaScript Style Guide Downloads Docker Pulls
Build + Publish Huntr GitHub Sponsors Open Collective backers and sponsors Subscribe to Newsletter
Chat on Slack Follow on Twitter Follow on Telegram Chat on Discord Reddit

A modern, lightweight and powerful wiki app built on NodeJS

Follow our Twitter feed to learn about upcoming updates and new releases!

Donate

Wiki.js is an open source project that has been made possible due to the generous contributions by community backers. If you are interested in supporting this project, please consider becoming a sponsor, becoming a patron, donating to our OpenCollective, via Paypal or via Ethereum (0xe1d55c19ae86f6bcbfb17e7f06ace96bdbb22cb5).

Become a Sponsor Become a Patron Donate on OpenCollective Donate via Paypal
Donate via Ethereum Donate via Bitcoin Buy a T-Shirt

Gold Tier Sponsors

GitHub Sponsors

Support this project by becoming a sponsor. Your name will show up in the Contribute page of all Wiki.js installations as well as here with a link to your website! [Become a sponsor]

Alexander Casassovici
(@alexksso) 		Broxen
(@broxen) 		Dacon
(@xDacon)
Jay Daley
(@JayDaley) 		Oleksii
(@idokka)

OpenCollective Sponsors

Support this project by becoming a sponsor. Your logo will show up in the Contribute page of all Wiki.js installations as well as here with a link to your website! [Become a sponsor]

Patreon Backers

Thank you to all our patrons! 🙏 [Become a patron]

  • Aeternum
  • Al Romano
  • Alex Balabanov
  • Alex Milanov
  • Alex Zen
  • Arti Zirk
  • Ave
  • Brandon Curtis
  • Damien Hottelier
  • Daniel T. Holtzclaw
  • Dave 'Sri' Seah
  • djagoo
  • dz
  • Douglas Lassance
  • Ergoflix
  • Ernie Reid
  • Etienne
  • Flemis Jurgenheimer
  • Florent
  • Günter Pavlas
  • hong
  • Hope
  • Ian
  • Imari Childress
  • Iskander Callos
  • Josh Stewart
  • Justin Dunsworth
  • Keir
  • Loïc CRAMPON
  • Ludgeir Ibanez
  • Lyn Matten
  • Mads Rosendahl
  • Mark Mansur
  • Matt Gedigian
  • Mike Ditton
  • Nate Figz
  • Patryk
  • Paul O'Fallon
  • Philipp Schürch
  • Tracey Duffy
  • Quaxim
  • Richeir
  • Sergio Navarro Fernández
  • Shad Narcher
  • ShadowVoyd
  • SmartNET.works
  • Stepan Sokolovskyi
  • Zach Crawford
  • Zach Maynard
  • 张白驹

OpenCollective Backers

Thank you to all our backers! 🙏 [Become a backer]

Contributors

This project exists thanks to all the people who contribute. [Contribute].

Special Thanks

Browserstack
Browserstack for providing access to their great cross-browser testing tools.

Cloudflare
Cloudflare for providing their great CDN, SSL and advanced networking services.

DigitalOcean
DigitalOcean for providing hosting of the Wiki.js documentation site and APIs.

Icons8
Icons8 for providing access to their beautiful icon sets.

Localazy
Localazy for providing access to their great localization service.

Lokalise
Lokalise for providing access to their great localization tool.

MacStadium
MacStadium for providing access to their Mac hardware in the cloud.

Netlify
Netlify for providing hosting for our website.

ngrok
ngrok for providing access to their great HTTP tunneling services.

Porkbun
Porkbun for providing domain registration services.

wiki_demo's People

Contributors

ngpixel avatar regevbr avatar sharonkoch avatar takumi9942 avatar myml avatar bamieh avatar ericfromcanada avatar broxen avatar alancnet avatar sbonaime avatar hieptuanle avatar sesajad avatar scienceasdf avatar cdn18 avatar wani4ka avatar mskrip avatar lkho avatar johnnyshields avatar user50000 avatar goto1134 avatar dbnicholson avatar natsutteatsuiyone avatar lub avatar gueldenstone avatar gh0stalker avatar daneallen avatar silicht avatar pwuts avatar philipcullen avatar nicolasg-rocketleap avatar

Stargazers

avatar

wiki_demo's Issues

apollo-fetch-0.7.0.tgz: 1 vulnerabilities (highest severity is: 6.5) - autoclosed

Vulnerable Library - apollo-fetch-0.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-fetch/node_modules/cross-fetch/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (apollo-fetch version) Remediation Possible**
CVE-2022-1365 Medium 6.5 cross-fetch-1.1.1.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-1365

Vulnerable Library - cross-fetch-1.1.1.tgz

Universal WHATWG Fetch API for Node, Browsers and React Native

Library home page: https://registry.npmjs.org/cross-fetch/-/cross-fetch-1.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-fetch/node_modules/cross-fetch/package.json

Dependency Hierarchy:

  • apollo-fetch-0.7.0.tgz (Root Library)
    • ❌ cross-fetch-1.1.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5.

Publish Date: 2022-04-15

URL: CVE-2022-1365

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1365

Release Date: 2022-04-15

Fix Resolution: cross-fetch - 3.1.5

cheerio-1.0.0-rc.5.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - cheerio-1.0.0-rc.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-select/node_modules/nth-check/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cheerio version) Remediation Possible**
CVE-2021-3803 High 7.5 nth-check-2.0.0.tgz Transitive 1.0.0 ✅
CVE-2021-33587 High 7.5 css-what-4.0.0.tgz Transitive 1.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-3803

Vulnerable Library - nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-select/node_modules/nth-check/package.json

Dependency Hierarchy:

  • cheerio-1.0.0-rc.5.tgz (Root Library)
    • cheerio-select-tmp-0.1.1.tgz
      • css-select-3.1.2.tgz
        • ❌ nth-check-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution (nth-check): 2.0.1

Direct dependency fix Resolution (cheerio): 1.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-33587

Vulnerable Library - css-what-4.0.0.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cheerio-select-tmp/node_modules/css-what/package.json,/node_modules/css-select/node_modules/css-what/package.json

Dependency Hierarchy:

  • cheerio-1.0.0-rc.5.tgz (Root Library)
    • cheerio-select-tmp-0.1.1.tgz
      • ❌ css-what-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (cheerio): 1.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

getos-3.2.1.tgz: 1 vulnerabilities (highest severity is: 7.8)

Vulnerable Library - getos-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (getos version) Remediation Possible**
CVE-2021-43138 High 7.8 async-3.2.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-43138

Vulnerable Library - async-3.2.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-3.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

  • getos-3.2.1.tgz (Root Library)
    • ❌ async-3.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - 2.6.4,3.2.2

Code Security Report: 10 total findings

Code Security Report

Scan Metadata

Latest Scan: 2024-05-26 05:07am
Total Findings: 10 | New Findings: 0 | Resolved Findings: 3
Tested Project Files: 361
Detected Programming Languages: 2 (JavaScript / TypeScript*, Go)

  • Check this box to manually trigger a scan

Finding Details

Automatic Remediation Available (2)

SeverityVulnerability TypeCWEFileData FlowsDate
LowUnvalidated/Open Redirect

CWE-601

auth.js:81

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/auth.js

Lines 76 to 81 in 9ab172a

if (loginRedirect === '/' && authResult.redirect) {
res.clearCookie('loginRedirect')
res.redirect(authResult.redirect)
} else if (loginRedirect) {
res.clearCookie('loginRedirect')
res.redirect(loginRedirect)

1 Data Flow/s detected

Wiki_Demo/server/controllers/auth.js

Line 66 in 9ab172a

router.all('/login/:strategy/callback', async (req, res, next) => {

Wiki_Demo/server/controllers/auth.js

Line 75 in 9ab172a

const loginRedirect = req.cookies['loginRedirect']

Wiki_Demo/server/controllers/auth.js

Line 81 in 9ab172a

res.redirect(loginRedirect)

⛑️ Remediation Suggestion

Wiki_Demo/diffs/82c5b557-0f71-4d4e-af35-f3cf08c45c03/auth.js.diff

Lines 1 to 223 in 72da563

--- original
+++ remediated
@@ -0,0 +0,0 @@
/* global WIKI */
const express = require('express')
const ExpressBrute = require('express-brute')
const BruteKnex = require('../helpers/brute-knex')
const router = express.Router()
const moment = require('moment')
const _ = require('lodash')
const bruteforce = new ExpressBrute(new BruteKnex({
createTable: true,
knex: WIKI.models.knex
}), {
freeRetries: 5,
minWait: 5 * 60 * 1000, // 5 minutes
maxWait: 60 * 60 * 1000, // 1 hour
failCallback: (req, res, next) => {
res.status(401).send('Too many failed attempts. Try again later.')
}
})
/**
* Login form
*/
router.get('/login', async (req, res, next) => {
_.set(res.locals, 'pageMeta.title', 'Login')
if (req.query.legacy || (req.get('user-agent') && req.get('user-agent').indexOf('Trident') >= 0)) {
const { formStrategies, socialStrategies } = await WIKI.models.authentication.getStrategiesForLegacyClient()
res.render('legacy/login', {
err: false,
formStrategies,
socialStrategies
})
} else {
// -> Bypass Login
if (WIKI.config.auth.autoLogin && !req.query.all) {
const stg = await WIKI.models.authentication.query().orderBy('order').first()
const stgInfo = _.find(WIKI.data.authentication, ['key', stg.strategyKey])
if (!stgInfo.useForm) {
return res.redirect(`/login/${stg.key}`)
}
}
// -> Show Login
const bgUrl = !_.isEmpty(WIKI.config.auth.loginBgUrl) ? WIKI.config.auth.loginBgUrl : '/_assets/img/splash/1.jpg'
res.render('login', { bgUrl, hideLocal: WIKI.config.auth.hideLocal })
}
})
/**
* Social Strategies Login
*/
router.get('/login/:strategy', async (req, res, next) => {
try {
await WIKI.models.users.login({
strategy: req.params.strategy
}, { req, res })
} catch (err) {
next(err)
}
})
/**
* Social Strategies Callback
*/
router.all('/login/:strategy/callback', async (req, res, next) => {
if (req.method !== 'GET' && req.method !== 'POST') { return next() }
try {
const authResult = await WIKI.models.users.login({
strategy: req.params.strategy
}, { req, res })
res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })
const loginRedirect = req.cookies['loginRedirect']
if (loginRedirect === '/' && authResult.redirect) {
res.clearCookie('loginRedirect')
@@ -78,1 +78,8 @@
- res.redirect(authResult.redirect)
+ const loginRedirect = req.cookies['loginRedirect'];
+ if (loginRedirect === '/' && authResult.redirect) {
+ res.clearCookie('loginRedirect');
+ if (authResult.redirect.startsWith('/') && !authResult.redirect.startsWith('//') && !authResult.redirect.includes('://')) {
+ res.redirect(authResult.redirect);
+ } else {
+ res.redirect('/');
+ }
} else if (loginRedirect) {
@@ -80,2 +87,6 @@
- res.clearCookie('loginRedirect')
- res.redirect(loginRedirect)
+ res.clearCookie('loginRedirect');
+ if (loginRedirect.startsWith('/') && !loginRedirect.startsWith('//') && !loginRedirect.includes('://')) {
+ res.redirect(loginRedirect);
+ } else {
+ res.redirect('/');
+ }
} else if (authResult.redirect) {
@@ -83,1 +94,5 @@
- res.redirect(authResult.redirect)
+ if (authResult.redirect.startsWith('/') && !authResult.redirect.startsWith('//') && !authResult.redirect.includes('://')) {
+ res.redirect(authResult.redirect);
+ } else {
+ res.redirect('/');
+ }
} else {
@@ -85,1 +100,1 @@
- res.redirect('/')
+ res.redirect('/');
}
} catch (err) {
next(err)
}
})
/**
* LEGACY - Login form handling
*/
router.post('/login', bruteforce.prevent, async (req, res, next) => {
_.set(res.locals, 'pageMeta.title', 'Login')
if (req.query.legacy || req.get('user-agent').indexOf('Trident') >= 0) {
try {
const authResult = await WIKI.models.users.login({
strategy: req.body.strategy,
username: req.body.user,
password: req.body.pass
}, { req, res })
req.brute.reset()
res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })
res.redirect('/')
} catch (err) {
const { formStrategies, socialStrategies } = await WIKI.models.authentication.getStrategiesForLegacyClient()
res.render('legacy/login', {
err,
formStrategies,
socialStrategies
})
}
} else {
res.redirect('/login')
}
})
/**
* Logout
*/
router.get('/logout', async (req, res) => {
const redirURL = await WIKI.models.users.logout({ req, res })
req.logout()
res.clearCookie('jwt')
res.redirect(redirURL)
})
/**
* Register form
*/
router.get('/register', async (req, res, next) => {
_.set(res.locals, 'pageMeta.title', 'Register')
const localStrg = await WIKI.models.authentication.getStrategy('local')
if (localStrg.selfRegistration) {
res.render('register')
} else {
next(new WIKI.Error.AuthRegistrationDisabled())
}
})
/**
* Verify
*/
router.get('/verify/:token', bruteforce.prevent, async (req, res, next) => {
try {
const usr = await WIKI.models.userKeys.validateToken({ kind: 'verify', token: req.params.token })
await WIKI.models.users.query().patch({ isVerified: true }).where('id', usr.id)
req.brute.reset()
if (WIKI.config.auth.enforce2FA) {
res.redirect('/login')
} else {
const result = await WIKI.models.users.refreshToken(usr)
res.cookie('jwt', result.token, { expires: moment().add(1, 'years').toDate() })
res.redirect('/')
}
} catch (err) {
next(err)
}
})
/**
* Reset Password
*/
router.get('/login-reset/:token', bruteforce.prevent, async (req, res, next) => {
try {
const usr = await WIKI.models.userKeys.validateToken({ kind: 'resetPwd', token: req.params.token })
if (!usr) {
throw new Error('Invalid Token')
}
req.brute.reset()
const changePwdContinuationToken = await WIKI.models.userKeys.generateToken({
userId: usr.id,
kind: 'changePwd'
})
const bgUrl = !_.isEmpty(WIKI.config.auth.loginBgUrl) ? WIKI.config.auth.loginBgUrl : '/_assets/img/splash/1.jpg'
res.render('login', { bgUrl, hideLocal: WIKI.config.auth.hideLocal, changePwdContinuationToken })
} catch (err) {
next(err)
}
})
/**
* JWT Public Endpoints
*/
router.get('/.well-known/jwk.json', function (req, res, next) {
res.json(WIKI.config.certs.jwk)
})
router.get('/.well-known/jwk.pem', function (req, res, next) {
res.send(WIKI.config.certs.public)
})
module.exports = router

  • Create Pull Request
Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Unvalidated/Open Redirect Training

● Videos

   ▪ Secure Code Warrior Unvalidated/Open Redirect Video

● Further Reading

   ▪ OWASP Unvalidated Redirects and Forwards Cheat Sheet

 
LowUnvalidated/Open Redirect

CWE-601

ssl.js:31

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/ssl.js

Lines 26 to 31 in 9ab172a

/**
* Redirect to HTTPS if HTTP Redirection is enabled
*/
router.all('/*', (req, res, next) => {
if (WIKI.config.server.sslRedir && !req.secure && WIKI.servers.servers.https) {
return res.redirect(`https://${req.hostname}${req.originalUrl}`)

1 Data Flow/s detected

Wiki_Demo/server/controllers/ssl.js

Line 29 in 9ab172a

router.all('/*', (req, res, next) => {

Wiki_Demo/server/controllers/ssl.js

Line 31 in 9ab172a

return res.redirect(`https://${req.hostname}${req.originalUrl}`)

⛑️ Remediation Suggestion

Wiki_Demo/diffs/5d2a3c05-e284-4ae3-b1e6-0f55a97d9369/ssl.js.diff

Lines 1 to 50 in 315c446

--- original
+++ remediated
@@ -0,0 +0,0 @@
const express = require('express')
const router = express.Router()
const _ = require('lodash')
const qs = require('querystring')
/* global WIKI */
/**
* Let's Encrypt Challenge
*/
router.get('/.well-known/acme-challenge/:token', (req, res, next) => {
res.type('text/plain')
if (_.get(WIKI.config, 'letsencrypt.challenge', false)) {
if (WIKI.config.letsencrypt.challenge.token === req.params.token) {
res.send(WIKI.config.letsencrypt.challenge.keyAuthorization)
WIKI.logger.info(`(LETSENCRYPT) Received valid challenge request. [ ACCEPTED ]`)
} else {
res.status(406).send('Invalid Challenge Token!')
WIKI.logger.warn(`(LETSENCRYPT) Received invalid challenge request. [ REJECTED ]`)
}
} else {
res.status(418).end()
}
})
/**
* Redirect to HTTPS if HTTP Redirection is enabled
*/
router.all('/*', (req, res, next) => {
if (WIKI.config.server.sslRedir && !req.secure && WIKI.servers.servers.https) {
@@ -31,1 +31,9 @@
- return res.redirect(`https://${req.hostname}${req.originalUrl}`)
+ if (WIKI.config.server.sslRedir && !req.secure && WIKI.servers.servers.https) {
+ if (req.hostname && req.originalUrl && req.hostname.startsWith(req.headers.host)) {
+ return res.redirect(`https://${req.hostname}${req.originalUrl}`);
+ } else {
+ res.status(400).send('Invalid redirect URL.');
+ }
+ } else {
+ next();
+ }
} else {
next()
}
})
module.exports = router

  • Create Pull Request
Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Unvalidated/Open Redirect Training

● Videos

   ▪ Secure Code Warrior Unvalidated/Open Redirect Video

● Further Reading

   ▪ OWASP Unvalidated Redirects and Forwards Cheat Sheet

No Automatic Remediation (8)

SeverityVulnerability TypeCWEFileData FlowsDate
MediumInsufficient Transport Layer Protection

CWE-319

mail.js:41

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/core/mail.js

Lines 36 to 41 in 9ab172a

keySelector: WIKI.config.mail.dkimKeySelector,
privateKey: WIKI.config.mail.dkimPrivateKey
}
}
}
this.transport = nodemailer.createTransport(conf)

1 Data Flow/s detected

Wiki_Demo/server/core/mail.js

Line 41 in 9ab172a

this.transport = nodemailer.createTransport(conf)

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Insufficient Transport Layer Protection Training

● Videos

   ▪ Secure Code Warrior Insufficient Transport Layer Protection Video

 
LowSensitive Cookie Without Secure

CWE-614

common.js:446

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/common.js

Lines 441 to 446 in 9ab172a

const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs)
// -> Check User Access
if (!effectivePermissions.pages.read) {
if (req.user.id === 2) {
res.cookie('loginRedirect', req.path, {

1 Data Flow/s detected

Wiki_Demo/server/controllers/common.js

Line 446 in 9ab172a

res.cookie('loginRedirect', req.path, {

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Training

● Videos

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Video

 
LowSensitive Cookie Without Secure

CWE-614

master.js:79

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/master.js

Lines 74 to 79 in 9ab172a

// ----------------------------------------
// Passport Authentication
// ----------------------------------------
app.use(cookieParser())
app.use(session({

1 Data Flow/s detected

Wiki_Demo/server/master.js

Line 79 in 9ab172a

app.use(session({

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Training

● Videos

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Video

 
LowSensitive Cookie Without Secure

CWE-614

auth.js:156

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/auth.js

Lines 151 to 156 in 9ab172a

req.brute.reset()
if (WIKI.config.auth.enforce2FA) {
res.redirect('/login')
} else {
const result = await WIKI.models.users.refreshToken(usr)
res.cookie('jwt', result.token, { expires: moment().add(1, 'years').toDate() })

1 Data Flow/s detected

Wiki_Demo/server/controllers/auth.js

Line 156 in 9ab172a

res.cookie('jwt', result.token, { expires: moment().add(1, 'years').toDate() })

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Training

● Videos

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Video

 
LowSensitive Cookie Without Secure

CWE-614

auth.js:73

22024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/auth.js

Lines 68 to 73 in 9ab172a

try {
const authResult = await WIKI.models.users.login({
strategy: req.params.strategy
}, { req, res })
res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

2 Data Flow/s detected
View Data Flow 1

Wiki_Demo/server/controllers/auth.js

Line 73 in 9ab172a

res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

View Data Flow 2

Wiki_Demo/server/controllers/auth.js

Line 106 in 9ab172a

res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Training

● Videos

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Video

 
LowSensitive Cookie Without Secure

CWE-614

auth.js:106

22024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/auth.js

Lines 101 to 106 in 9ab172a

strategy: req.body.strategy,
username: req.body.user,
password: req.body.pass
}, { req, res })
req.brute.reset()
res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

2 Data Flow/s detected
View Data Flow 1

Wiki_Demo/server/controllers/auth.js

Line 73 in 9ab172a

res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

View Data Flow 2

Wiki_Demo/server/controllers/auth.js

Line 106 in 9ab172a

res.cookie('jwt', authResult.jwt, { expires: moment().add(1, 'y').toDate() })

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Training

● Videos

   ▪ Secure Code Warrior Sensitive Cookie Without Secure Video

 
LowImproper Input Validation

CWE-20

common.js:446

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/common.js

Lines 441 to 446 in 9ab172a

const effectivePermissions = WIKI.auth.getEffectivePermissions(req, pageArgs)
// -> Check User Access
if (!effectivePermissions.pages.read) {
if (req.user.id === 2) {
res.cookie('loginRedirect', req.path, {

1 Data Flow/s detected

Wiki_Demo/server/controllers/common.js

Line 417 in 9ab172a

router.get('/*', async (req, res, next) => {

Secure Code Warrior Training Material
 
LowCookie Without 'HttpOnly' Flag

CWE-1004

common.js:446

12024-05-16 06:54am
Vulnerable Code

Wiki_Demo/server/controllers/common.js

Line 446 in 9ab172a

res.cookie('loginRedirect', req.path, {

Secure Code Warrior Training Material

● Training

   ▪ Secure Code Warrior Cookie Without 'HttpOnly' Flag Training

● Videos

   ▪ Secure Code Warrior Cookie Without 'HttpOnly' Flag Video

diff2html-3.1.14.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - diff2html-3.1.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff2html/node_modules/highlight.js/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (diff2html version) Remediation Possible**
WS-2020-0208 Medium 5.3 highlight.js-10.2.1.tgz Transitive 3.1.15 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2020-0208

Vulnerable Library - highlight.js-10.2.1.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-10.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff2html/node_modules/highlight.js/package.json

Dependency Hierarchy:

  • diff2html-3.1.14.tgz (Root Library)
    • ❌ highlight.js-10.2.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.

Publish Date: 2020-12-04

URL: WS-2020-0208

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-04

Fix Resolution (highlight.js): 10.4.1

Direct dependency fix Resolution (diff2html): 3.1.15

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

markdown-it-11.0.1.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - markdown-it-11.0.1.tgz

Markdown-it - modern pluggable markdown parser.

Library home page: https://registry.npmjs.org/markdown-it/-/markdown-it-11.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/markdown-it/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (markdown-it version) Remediation Possible**
CVE-2022-21670 Medium 5.3 markdown-it-11.0.1.tgz Direct 12.3.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-21670

Vulnerable Library - markdown-it-11.0.1.tgz

Markdown-it - modern pluggable markdown parser.

Library home page: https://registry.npmjs.org/markdown-it/-/markdown-it-11.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/markdown-it/package.json

Dependency Hierarchy:

  • ❌ markdown-it-11.0.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

markdown-it is a Markdown parser. Prior to version 1.3.2, special patterns with length greater than 50 thousand characterss could slow down the parser significantly. Users should upgrade to version 12.3.2 to receive a patch. There are no known workarounds aside from upgrading.

Publish Date: 2022-01-10

URL: CVE-2022-21670

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6vfc-qv3f-vr6c

Release Date: 2022-01-10

Fix Resolution: 12.3.2

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

passport-twitch-strategy-2.2.0.tgz: 1 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - passport-twitch-strategy-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server-env/node_modules/node-fetch/package.json,/node_modules/passport-twitch-strategy/node_modules/node-fetch/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-twitch-strategy version) Remediation Possible**
CVE-2022-0235 Medium 6.1 node-fetch-2.6.6.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.6.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server-env/node_modules/node-fetch/package.json,/node_modules/passport-twitch-strategy/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • passport-twitch-strategy-2.2.0.tgz (Root Library)
    • ❌ node-fetch-2.6.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution: node-fetch - 2.6.7,3.1.1

pg-pubsub-0.5.0.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - pg-pubsub-0.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/pg-pubsub/node_modules/semver/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (pg-pubsub version) Remediation Possible**
CVE-2022-25883 Medium 5.3 semver-4.3.2.tgz Transitive 0.6.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-4.3.2.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-4.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/pg-pubsub/node_modules/semver/package.json

Dependency Hierarchy:

  • pg-pubsub-0.5.0.tgz (Root Library)
    • pg-7.18.1.tgz
      • ❌ semver-4.3.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (pg-pubsub): 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

apollo-server-2.25.2.tgz: 5 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - apollo-server-2.25.2.tgz

Production ready GraphQL Server

Library home page: https://registry.npmjs.org/apollo-server/-/apollo-server-2.25.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (apollo-server version) Remediation Possible**
WS-2022-0331 High 8.8 apollo-server-2.25.2.tgz Direct 2.25.4 ✅
CVE-2020-15256 High 7.7 object-path-0.11.4.tgz Transitive 2.25.3 ✅
CVE-2022-24434 High 7.5 dicer-0.3.0.tgz Transitive N/A* ❌
CVE-2021-3805 High 7.5 object-path-0.11.4.tgz Transitive 2.25.3 ✅
CVE-2021-23434 Medium 5.6 object-path-0.11.4.tgz Transitive 2.25.3 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2022-0331

Vulnerable Library - apollo-server-2.25.2.tgz

Production ready GraphQL Server

Library home page: https://registry.npmjs.org/apollo-server/-/apollo-server-2.25.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/package.json

Dependency Hierarchy:

  • ❌ apollo-server-2.25.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The graphql-upload library included in Apollo Server 2 2.0.0 and before 2.25.4 is vulnerable to CSRF mutations

Publish Date: 2022-10-12

URL: WS-2022-0331

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2p3c-p3qw-69r4

Release Date: 2022-10-12

Fix Resolution: 2.25.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-15256

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • apollo-server-2.25.2.tgz (Root Library)
    • apollo-server-core-2.25.3.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • ❌ object-path-0.11.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability has been found in object-path <= 0.11.4 affecting the set() method. The vulnerability is limited to the includeInheritedProps mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of object-path and setting the option includeInheritedProps: true, or by using the default withInheritedProps instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of set() in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the includeInheritedProps: true options or the withInheritedProps instance if using a version >= 0.11.0.

Publish Date: 2020-10-19

URL: CVE-2020-15256

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cwx2-736x-mf6w

Release Date: 2020-10-19

Fix Resolution (object-path): 0.11.5

Direct dependency fix Resolution (apollo-server): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24434

Vulnerable Library - dicer-0.3.0.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@apollographql/graphql-upload-8-fork/node_modules/dicer/package.json

Dependency Hierarchy:

  • apollo-server-2.25.2.tgz (Root Library)
    • apollo-server-core-2.25.3.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • busboy-0.3.1.tgz
          • ❌ dicer-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2021-3805

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • apollo-server-2.25.2.tgz (Root Library)
    • apollo-server-core-2.25.3.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • ❌ object-path-0.11.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

object-path is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-09-17

URL: CVE-2021-3805

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/571e3baf-7c46-46e3-9003-ba7e4e623053/

Release Date: 2021-09-17

Fix Resolution (object-path): 0.11.8

Direct dependency fix Resolution (apollo-server): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23434

Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/object-path/package.json

Dependency Hierarchy:

  • apollo-server-2.25.2.tgz (Root Library)
    • apollo-server-core-2.25.3.tgz
      • graphql-upload-8-fork-8.1.3.tgz
        • ❌ object-path-0.11.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === 'proto' returns false if currentPath is ['proto']. This is because the === operator returns always false when the type of the operands is different.

Publish Date: 2021-08-27

URL: CVE-2021-23434

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434

Release Date: 2021-08-27

Fix Resolution (object-path): 0.11.6

Direct dependency fix Resolution (apollo-server): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

jsdom-16.4.0.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jsdom-16.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsdom/node_modules/ws/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jsdom version) Remediation Possible**
CVE-2024-37890 High 7.5 ws-7.2.5.tgz Transitive 16.5.0 ✅
CVE-2022-24999 High 7.5 qs-6.5.2.tgz Transitive 16.5.0 ✅
CVE-2023-26136 Medium 6.5 tough-cookie-3.0.1.tgz Transitive 16.6.0 ✅
CVE-2021-32640 Medium 5.3 ws-7.2.5.tgz Transitive 16.5.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-37890

Vulnerable Library - ws-7.2.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsdom/node_modules/ws/package.json

Dependency Hierarchy:

  • jsdom-16.4.0.tgz (Root Library)
    • ❌ ws-7.2.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (jsdom): 16.5.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • jsdom-16.4.0.tgz (Root Library)
    • request-2.88.2.tgz
      • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (jsdom): 16.5.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26136

Vulnerable Library - tough-cookie-3.0.1.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-3.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsdom/node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • jsdom-16.4.0.tgz (Root Library)
    • ❌ tough-cookie-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (jsdom): 16.6.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32640

Vulnerable Library - ws-7.2.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsdom/node_modules/ws/package.json

Dependency Hierarchy:

  • jsdom-16.4.0.tgz (Root Library)
    • ❌ ws-7.2.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution (ws): 7.4.6

Direct dependency fix Resolution (jsdom): 16.5.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

graphql-tools-7.0.0.tgz: 21 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - graphql-tools-7.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/knex/node_modules/lodash/package.json,/node_modules/@graphql-tools/resolvers-composition/node_modules/lodash/package.json,/node_modules/connect-session-knex/node_modules/lodash/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (graphql-tools version) Remediation Possible**
CVE-2021-44906 Critical 9.8 minimist-1.2.5.tgz Transitive 7.0.1 ✅
CVE-2023-45133 Critical 9.3 detected in multiple dependencies Transitive 8.0.0 ✅
CVE-2022-3517 High 7.5 minimatch-3.0.4.tgz Transitive N/A* ❌
CVE-2021-27292 High 7.5 ua-parser-js-0.7.21.tgz Transitive 7.0.1 ✅
CVE-2020-7793 High 7.5 ua-parser-js-0.7.21.tgz Transitive 7.0.1 ✅
CVE-2020-7733 High 7.5 ua-parser-js-0.7.21.tgz Transitive 7.0.1 ✅
CVE-2020-8203 High 7.4 lodash-4.17.15.tgz Transitive 7.0.1 ✅
CVE-2020-7774 High 7.3 y18n-4.0.0.tgz Transitive 7.0.1 ✅
CVE-2021-23337 High 7.2 detected in multiple dependencies Transitive 7.0.1 ✅
CVE-2022-46175 High 7.1 json5-2.1.2.tgz Transitive 7.0.1 ✅
CVE-2021-23326 Medium 6.3 git-loader-6.2.5.tgz Transitive 7.0.1 ✅
CVE-2022-0235 Medium 6.1 node-fetch-2.6.1.tgz Transitive 8.0.0 ✅
CVE-2024-4067 Medium 5.3 micromatch-4.0.2.tgz Transitive N/A* ❌
CVE-2022-25883 Medium 5.3 semver-5.7.1.tgz Transitive 7.0.1 ✅
CVE-2022-25858 Medium 5.3 terser-5.3.4.tgz Transitive 7.0.1 ✅
CVE-2021-23343 Medium 5.3 path-parse-1.0.6.tgz Transitive 7.0.1 ✅
CVE-2020-28500 Medium 5.3 detected in multiple dependencies Transitive 7.0.1 ✅
CVE-2020-28469 Medium 5.3 glob-parent-5.1.1.tgz Transitive 7.0.1 ✅
CVE-2024-6783 Medium 4.8 vue-template-compiler-2.6.12.tgz Transitive N/A* ❌
CVE-2017-16137 Low 3.7 debug-4.1.1.tgz Transitive 7.0.1 ✅
CVE-2024-27088 Low 0.0 es5-ext-0.10.51.tgz Transitive 7.0.1 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-44906

Vulnerable Library - minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/multer/node_modules/minimist/package.json,/node_modules/json5/node_modules/minimist/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • core-7.10.4.tgz
          • json5-2.1.2.tgz
            • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-45133

Vulnerable Libraries - traverse-7.10.4.tgz, traverse-7.11.5.tgz

traverse-7.10.4.tgz

The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.10.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/traverse/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • ❌ traverse-7.10.4.tgz (Vulnerable Library)

traverse-7.11.5.tgz

The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.11.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/graphql-tag-pluck/node_modules/@babel/traverse/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • graphql-tag-pluck-6.2.6.tgz
      • ❌ traverse-7.11.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (graphql-tools): 8.0.0

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (graphql-tools): 8.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-3517

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • glob-7.1.4.tgz
          • ❌ minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2021-27292

Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ua-parser-js/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • fbjs-1.0.0.tgz
          • ❌ ua-parser-js-0.7.21.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Publish Date: 2021-03-17

URL: CVE-2021-27292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27292

Release Date: 2021-03-17

Fix Resolution (ua-parser-js): 0.7.24

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7793

Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ua-parser-js/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • fbjs-1.0.0.tgz
          • ❌ ua-parser-js-0.7.21.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).

Publish Date: 2020-12-11

URL: CVE-2020-7793

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-11

Fix Resolution (ua-parser-js): 0.7.23

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7733

Vulnerable Library - ua-parser-js-0.7.21.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ua-parser-js/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • fbjs-1.0.0.tgz
          • ❌ ua-parser-js-0.7.21.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

Publish Date: 2020-09-16

URL: CVE-2020-7733

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-16

Fix Resolution (ua-parser-js): 0.7.22

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-8203

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/types/node_modules/lodash/package.json,/node_modules/@babel/helper-module-transforms/node_modules/lodash/package.json,/node_modules/@babel/helper-define-map/node_modules/lodash/package.json,/node_modules/@babel/generator/node_modules/lodash/package.json,/node_modules/ip-address/node_modules/lodash/package.json,/node_modules/relay-compiler/node_modules/lodash/package.json,/node_modules/passport-azure-ad/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-block-scoping/node_modules/lodash/package.json,/node_modules/@babel/traverse/node_modules/lodash/package.json,/node_modules/request-promise-native/node_modules/lodash/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • types-7.6.1.tgz
          • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.19

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7774

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • yargs-15.3.1.tgz
          • ❌ y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 4.0.1

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23337

Vulnerable Libraries - lodash-4.17.15.tgz, lodash-4.17.20.tgz

lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/types/node_modules/lodash/package.json,/node_modules/@babel/helper-module-transforms/node_modules/lodash/package.json,/node_modules/@babel/helper-define-map/node_modules/lodash/package.json,/node_modules/@babel/generator/node_modules/lodash/package.json,/node_modules/ip-address/node_modules/lodash/package.json,/node_modules/relay-compiler/node_modules/lodash/package.json,/node_modules/passport-azure-ad/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-block-scoping/node_modules/lodash/package.json,/node_modules/@babel/traverse/node_modules/lodash/package.json,/node_modules/request-promise-native/node_modules/lodash/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • types-7.6.1.tgz
          • ❌ lodash-4.17.15.tgz (Vulnerable Library)

lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/knex/node_modules/lodash/package.json,/node_modules/@graphql-tools/resolvers-composition/node_modules/lodash/package.json,/node_modules/connect-session-knex/node_modules/lodash/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • resolvers-composition-6.2.5.tgz
      • ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (graphql-tools): 7.0.1

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-46175

Vulnerable Library - json5-2.1.2.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • core-7.10.4.tgz
          • ❌ json5-2.1.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 2.2.2

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23326

Vulnerable Library - git-loader-6.2.5.tgz

A set of utils for faster development of GraphQL tools

Library home page: https://registry.npmjs.org/@graphql-tools/git-loader/-/git-loader-6.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/git-loader/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • ❌ git-loader-6.2.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects the package @graphql-tools/git-loader before 6.2.6. The use of exec and execSync in packages/loaders/git/src/load-git.ts allows arbitrary command injection.

Publish Date: 2021-01-20

URL: CVE-2021-23326

CVSS 3 Score Details (6.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-20

Fix Resolution (@graphql-tools/git-loader): 6.2.6

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.1.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cross-fetch/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • links-6.2.5.tgz
      • cross-fetch-3.0.6.tgz
        • ❌ node-fetch-2.6.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (graphql-tools): 8.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4067

Vulnerable Library - micromatch-4.0.2.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • load-files-6.2.4.tgz
      • globby-11.0.1.tgz
        • fast-glob-3.2.2.tgz
          • ❌ micromatch-4.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 should not reflect the security risk score in NVD, but will be kept for users' awareness.

Publish Date: 2024-05-13

URL: CVE-2024-4067

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: micromatch - 4.0.8

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/require_optional/node_modules/semver/package.json,/node_modules/@babel/core/node_modules/semver/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • core-7.10.4.tgz
          • ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25858

Vulnerable Library - terser-5.3.4.tgz

JavaScript parser, mangler/compressor and beautifier toolkit for ES6+

Library home page: https://registry.npmjs.org/terser/-/terser-5.3.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@apollo/client/node_modules/terser/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • links-6.2.5.tgz
      • apollo-upload-client-14.1.2.tgz
        • client-3.2.2.tgz
          • ❌ terser-5.3.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Publish Date: 2022-07-15

URL: CVE-2022-25858

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25858

Release Date: 2022-07-15

Fix Resolution (terser): 5.14.2

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23343

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • core-7.10.4.tgz
          • resolve-1.12.0.tgz
            • ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28500

Vulnerable Libraries - lodash-4.17.15.tgz, lodash-4.17.20.tgz

lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/types/node_modules/lodash/package.json,/node_modules/@babel/helper-module-transforms/node_modules/lodash/package.json,/node_modules/@babel/helper-define-map/node_modules/lodash/package.json,/node_modules/@babel/generator/node_modules/lodash/package.json,/node_modules/ip-address/node_modules/lodash/package.json,/node_modules/relay-compiler/node_modules/lodash/package.json,/node_modules/passport-azure-ad/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-block-scoping/node_modules/lodash/package.json,/node_modules/@babel/traverse/node_modules/lodash/package.json,/node_modules/request-promise-native/node_modules/lodash/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • types-7.6.1.tgz
          • ❌ lodash-4.17.15.tgz (Vulnerable Library)

lodash-4.17.20.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/knex/node_modules/lodash/package.json,/node_modules/@graphql-tools/resolvers-composition/node_modules/lodash/package.json,/node_modules/connect-session-knex/node_modules/lodash/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • resolvers-composition-6.2.5.tgz
      • ❌ lodash-4.17.20.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (graphql-tools): 7.0.1

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28469

Vulnerable Library - glob-parent-5.1.1.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • load-files-6.2.4.tgz
      • globby-11.0.1.tgz
        • fast-glob-3.2.2.tgz
          • ❌ glob-parent-5.1.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-6783

Vulnerable Library - vue-template-compiler-2.6.12.tgz

template compiler for Vue 2.0

Library home page: https://registry.npmjs.org/vue-template-compiler/-/vue-template-compiler-2.6.12.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/graphql-tag-pluck/node_modules/vue-template-compiler/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • graphql-tag-pluck-6.2.6.tgz
      • ❌ vue-template-compiler-2.6.12.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as Object.prototype.staticClass or Object.prototype.staticStyle to execute arbitrary JavaScript code.

Publish Date: 2024-07-23

URL: CVE-2024-6783

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2017-16137

Vulnerable Library - debug-4.1.1.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/debug/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • relay-operation-optimizer-6.2.5.tgz
      • relay-compiler-10.0.1.tgz
        • traverse-7.10.4.tgz
          • ❌ debug-4.1.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-04-26

URL: CVE-2017-16137

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution (debug): 4.3.1

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-27088

Vulnerable Library - es5-ext-0.10.51.tgz

ECMAScript extensions and shims

Library home page: https://registry.npmjs.org/es5-ext/-/es5-ext-0.10.51.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/es5-ext/package.json

Dependency Hierarchy:

  • graphql-tools-7.0.0.tgz (Root Library)
    • url-loader-6.3.1.tgz
      • websocket-1.0.32.tgz
        • ❌ es5-ext-0.10.51.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

es5-ext contains ECMAScript 5 extensions. Passing functions with very long names or complex default argument names into function#copy or function#toStringTokens may cause the script to stall. The vulnerability is patched in v0.10.63.

Publish Date: 2024-02-26

URL: CVE-2024-27088

CVSS 3 Score Details (0.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-27088

Release Date: 2024-02-26

Fix Resolution (es5-ext): 0.10.63

Direct dependency fix Resolution (graphql-tools): 7.0.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

passport-saml-3.2.4.tgz: 3 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - passport-saml-3.2.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-saml/node_modules/xml2js/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-saml version) Remediation Possible**
CVE-2022-37616 Critical 9.8 xmldom-0.7.5.tgz Transitive N/A* ❌
CVE-2022-39353 Critical 9.4 xmldom-0.7.5.tgz Transitive N/A* ❌
CVE-2023-0842 Medium 5.3 xml2js-0.4.23.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-37616

Vulnerable Library - xmldom-0.7.5.tgz

A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@xmldom/xmldom/package.json

Dependency Hierarchy:

  • passport-saml-3.2.4.tgz (Root Library)
    • xml-encryption-2.0.0.tgz
      • ❌ xmldom-0.7.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability exists in the function copy in dom.js in the xmldom (published as @xmldom/xmldom) package before 0.8.3 for Node.js via the p variable. NOTE: the vendor states "we are in the process of marking this report as invalid"; however, some third parties takes the position that "A prototype injection/Prototype pollution is not just when global objects are polluted with recursive merge or deep cloning but also when a target object is polluted."

Publish Date: 2022-10-11

URL: CVE-2022-37616

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-37616

Release Date: 2022-10-11

Fix Resolution: @xmldom/xmldom - 0.8.3

CVE-2022-39353

Vulnerable Library - xmldom-0.7.5.tgz

A pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module.

Library home page: https://registry.npmjs.org/@xmldom/xmldom/-/xmldom-0.7.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@xmldom/xmldom/package.json

Dependency Hierarchy:

  • passport-saml-3.2.4.tgz (Root Library)
    • xml-encryption-2.0.0.tgz
      • ❌ xmldom-0.7.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the documentElementor reject a document with a document that has more then 1 childNode.

Publish Date: 2022-11-02

URL: CVE-2022-39353

CVSS 3 Score Details (9.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crh6-fp67-6883

Release Date: 2022-11-02

Fix Resolution: @xmldom/xmldom - 0.7.7,0.8.4

CVE-2023-0842

Vulnerable Library - xml2js-0.4.23.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-saml/node_modules/xml2js/package.json

Dependency Hierarchy:

  • passport-saml-3.2.4.tgz (Root Library)
    • ❌ xml2js-0.4.23.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution: xml2js - 0.5.0

patch-package-8.0.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - patch-package-8.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (patch-package version) Remediation Possible**
CVE-2024-4068 High 7.5 braces-3.0.2.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

  • patch-package-8.0.0.tgz (Root Library)
    • find-yarn-workspace-root-2.0.0.tgz
      • micromatch-4.0.2.tgz
        • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

file-type-15.0.1.tgz: 1 vulnerabilities (highest severity is: 5.5) - autoclosed

Vulnerable Library - file-type-15.0.1.tgz

Detect the file type of a Buffer/Uint8Array/ArrayBuffer

Library home page: https://registry.npmjs.org/file-type/-/file-type-15.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/file-type/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (file-type version) Remediation Possible**
CVE-2022-36313 Medium 5.5 file-type-15.0.1.tgz Direct 16.5.4 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-36313

Vulnerable Library - file-type-15.0.1.tgz

Detect the file type of a Buffer/Uint8Array/ArrayBuffer

Library home page: https://registry.npmjs.org/file-type/-/file-type-15.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/file-type/package.json

Dependency Hierarchy:

  • ❌ file-type-15.0.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to get caught in an infinite loop. This would make the application become unresponsive and could be used to cause a DoS attack.

Publish Date: 2022-07-21

URL: CVE-2022-36313

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-07-21

Fix Resolution: 16.5.4

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

subscriptions-transport-ws-0.9.18.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - subscriptions-transport-ws-0.9.18.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (subscriptions-transport-ws version) Remediation Possible**
CVE-2024-37890 High 7.5 ws-5.2.2.tgz Transitive 0.9.19 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-37890

Vulnerable Library - ws-5.2.2.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-5.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ws/package.json

Dependency Hierarchy:

  • subscriptions-transport-ws-0.9.18.tgz (Root Library)
    • ❌ ws-5.2.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 5.2.4

Direct dependency fix Resolution (subscriptions-transport-ws): 0.9.19

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

multer-1.4.4.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - multer-1.4.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (multer version) Remediation Possible**
CVE-2022-24434 High 7.5 dicer-0.2.5.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24434

Vulnerable Library - dicer-0.2.5.tgz

A very fast streaming multipart parser for node.js

Library home page: https://registry.npmjs.org/dicer/-/dicer-0.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/dicer/package.json

Dependency Hierarchy:

  • multer-1.4.4.tgz (Root Library)
    • busboy-0.2.14.tgz
      • ❌ dicer-0.2.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.

Publish Date: 2022-05-20

URL: CVE-2022-24434

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

pug-3.0.2.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - pug-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (pug version) Remediation Possible**
CVE-2021-23343 High 7.5 path-parse-1.0.6.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23343

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy:

  • pug-3.0.2.tgz (Root Library)
    • pug-filters-4.0.0.tgz
      • resolve-1.17.0.tgz
        • ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

express-4.18.2.tgz: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - express-4.18.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express version) Remediation Possible**
CVE-2024-29041 Medium 6.1 express-4.18.2.tgz Direct 4.19.0 ✅
CVE-2024-43800 Medium 5.0 serve-static-1.15.0.tgz Transitive N/A* ❌
CVE-2024-43799 Medium 5.0 send-0.18.0.tgz Transitive N/A* ❌
CVE-2024-43796 Medium 5.0 express-4.18.2.tgz Direct express - 4.20.0,5.0.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-29041

Vulnerable Library - express-4.18.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy:

  • ❌ express-4.18.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-43800

Vulnerable Library - serve-static-1.15.0.tgz

Serve static files

Library home page: https://registry.npmjs.org/serve-static/-/serve-static-1.15.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serve-static/package.json

Dependency Hierarchy:

  • express-4.18.2.tgz (Root Library)
    • ❌ serve-static-1.15.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.

Publish Date: 2024-09-10

URL: CVE-2024-43800

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cm22-4g7w-348p

Release Date: 2024-09-10

Fix Resolution: serve-static - 1.16.0,2.1.0

CVE-2024-43799

Vulnerable Library - send-0.18.0.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.18.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/node_modules/send/package.json

Dependency Hierarchy:

  • express-4.18.2.tgz (Root Library)
    • ❌ send-0.18.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

Publish Date: 2024-09-10

URL: CVE-2024-43799

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m6fv-jmcg-4jfg

Release Date: 2024-09-10

Fix Resolution: send - 0.19.0

CVE-2024-43796

Vulnerable Library - express-4.18.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy:

  • ❌ express-4.18.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

Publish Date: 2024-09-10

URL: CVE-2024-43796

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qw6h-vgh9-j6wx

Release Date: 2024-09-10

Fix Resolution: express - 4.20.0,5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

ssh2-1.11.0.tgz: 1 vulnerabilities (highest severity is: 5.9)

Vulnerable Library - ssh2-1.11.0.tgz

SSH2 client and server modules written in pure JavaScript for node.js

Library home page: https://registry.npmjs.org/ssh2/-/ssh2-1.11.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ssh2/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (ssh2 version) Remediation Possible**
CVE-2023-48795 Medium 5.9 ssh2-1.11.0.tgz Direct putty - 0.80, openssh - V_9_6_P1, golang/crypto - v0.17.0, asyncssh - 2.14.2, libssh-0.9.8, libssh-0.10.6, teraterm - v5.1, paramiko - 3.4.0, russh - 0.40.2, com.github.mwiede:jsch:0.2.15, proftpd - v1.3.8b, thrussh - 0.35.1, teraterm - v5.1, org.connectbot:sshlib:2.2.22, mscdex/ssh2 - 1.15.0, jtesta/ssh-audit - v3.1.0, Oryx-Embedded/CycloneSSH - v2.3.4, opnsense/src - 23.7, winscp - 6.2.2, PowerShell/openssh-portable - v9.5.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-48795

Vulnerable Library - ssh2-1.11.0.tgz

SSH2 client and server modules written in pure JavaScript for node.js

Library home page: https://registry.npmjs.org/ssh2/-/ssh2-1.11.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ssh2/package.json

Dependency Hierarchy:

  • ❌ ssh2-1.11.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in [email protected] and (if CBC is used) the [email protected] MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.

Publish Date: 2023-12-18

URL: CVE-2023-48795

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://security-tracker.debian.org/tracker/CVE-2023-48795

Release Date: 2023-12-18

Fix Resolution: putty - 0.80, openssh - V_9_6_P1, golang/crypto - v0.17.0, asyncssh - 2.14.2, libssh-0.9.8, libssh-0.10.6, teraterm - v5.1, paramiko - 3.4.0, russh - 0.40.2, com.github.mwiede:jsch:0.2.15, proftpd - v1.3.8b, thrussh - 0.35.1, teraterm - v5.1, org.connectbot:sshlib:2.2.22, mscdex/ssh2 - 1.15.0, jtesta/ssh-audit - v3.1.0, Oryx-Embedded/CycloneSSH - v2.3.4, opnsense/src - 23.7, winscp - 6.2.2, PowerShell/openssh-portable - v9.5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

semver-7.3.8.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (semver version) Remediation Possible**
CVE-2022-25883 Medium 5.3 semver-7.3.8.tgz Direct 7.5.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Dependency Hierarchy:

  • ❌ semver-7.3.8.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: 7.5.2

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

passport-microsoft-0.1.0.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - passport-microsoft-0.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-microsoft/node_modules/passport-oauth2/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-microsoft version) Remediation Possible**
CVE-2021-41580 Medium 5.3 passport-oauth2-1.2.0.tgz Transitive 1.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-41580

Vulnerable Library - passport-oauth2-1.2.0.tgz

OAuth 2.0 authentication strategy for Passport.

Library home page: https://registry.npmjs.org/passport-oauth2/-/passport-oauth2-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-microsoft/node_modules/passport-oauth2/package.json

Dependency Hierarchy:

  • passport-microsoft-0.1.0.tgz (Root Library)
    • ❌ passport-oauth2-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability

Publish Date: 2021-09-27

URL: CVE-2021-41580

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41580

Release Date: 2021-09-27

Fix Resolution (passport-oauth2): 1.6.1

Direct dependency fix Resolution (passport-microsoft): 1.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

request-promise-4.2.6.tgz: 3 vulnerabilities (highest severity is: 7.2)

Vulnerable Library - request-promise-4.2.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/graphql-tag-pluck/node_modules/lodash/package.json,/node_modules/request-promise-core/node_modules/lodash/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (request-promise version) Remediation Possible**
CVE-2021-23337 High 7.2 lodash-4.17.19.tgz Transitive N/A* ❌
CVE-2023-26136 Medium 6.5 tough-cookie-2.5.0.tgz Transitive N/A* ❌
CVE-2020-28500 Medium 5.3 lodash-4.17.19.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-23337

Vulnerable Library - lodash-4.17.19.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/graphql-tag-pluck/node_modules/lodash/package.json,/node_modules/request-promise-core/node_modules/lodash/package.json

Dependency Hierarchy:

  • request-promise-4.2.6.tgz (Root Library)
    • request-promise-core-1.1.4.tgz
      • ❌ lodash-4.17.19.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21, lodash-es - 4.17.21

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • request-promise-4.2.6.tgz (Root Library)
    • ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution: tough-cookie - 4.1.3

CVE-2020-28500

Vulnerable Library - lodash-4.17.19.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@graphql-tools/graphql-tag-pluck/node_modules/lodash/package.json,/node_modules/request-promise-core/node_modules/lodash/package.json

Dependency Hierarchy:

  • request-promise-4.2.6.tgz (Root Library)
    • request-promise-core-1.1.4.tgz
      • ❌ lodash-4.17.19.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21

passport-auth0-1.4.3.tgz: 3 vulnerabilities (highest severity is: 6.5) - autoclosed

Vulnerable Library - passport-auth0-1.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-auth0 version) Remediation Possible**
CVE-2024-28849 Medium 6.5 follow-redirects-1.15.2.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 axios-0.27.2.tgz Transitive N/A* ❌
CVE-2023-26159 Medium 6.1 follow-redirects-1.15.2.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28849

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • passport-auth0-1.4.3.tgz (Root Library)
    • axios-0.27.2.tgz
      • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2023-45857

Vulnerable Library - axios-0.27.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.27.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • passport-auth0-1.4.3.tgz (Root Library)
    • ❌ axios-0.27.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: axios - 1.6.0

CVE-2023-26159

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • passport-auth0-1.4.3.tgz (Root Library)
    • axios-0.27.2.tgz
      • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution: follow-redirects - 1.15.4

akismet-api-5.3.0.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - akismet-api-5.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/akismet-api/node_modules/semver/package.json,/node_modules/@mapbox/node-pre-gyp/node_modules/semver/package.json,/node_modules/@npmcli/fs/node_modules/semver/package.json,/node_modules/node-gyp/node_modules/semver/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (akismet-api version) Remediation Possible**
CVE-2022-24999 High 7.5 qs-6.9.3.tgz Transitive 6.0.0 ✅
CVE-2022-25901 Medium 5.3 cookiejar-2.1.3.tgz Transitive 6.0.0 ✅
CVE-2022-25883 Medium 5.3 semver-7.3.7.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.9.3.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.9.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/akismet-api/node_modules/formidable/node_modules/qs/package.json

Dependency Hierarchy:

  • akismet-api-5.3.0.tgz (Root Library)
    • superagent-7.1.3.tgz
      • formidable-2.0.1.tgz
        • ❌ qs-6.9.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.9.7

Direct dependency fix Resolution (akismet-api): 6.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25901

Vulnerable Library - cookiejar-2.1.3.tgz

simple persistent cookiejar system

Library home page: https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/akismet-api/node_modules/cookiejar/package.json

Dependency Hierarchy:

  • akismet-api-5.3.0.tgz (Root Library)
    • superagent-7.1.3.tgz
      • ❌ cookiejar-2.1.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

Publish Date: 2023-01-18

URL: CVE-2022-25901

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-18

Fix Resolution (cookiejar): 2.1.4

Direct dependency fix Resolution (akismet-api): 6.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Library - semver-7.3.7.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/akismet-api/node_modules/semver/package.json,/node_modules/@mapbox/node-pre-gyp/node_modules/semver/package.json,/node_modules/@npmcli/fs/node_modules/semver/package.json,/node_modules/node-gyp/node_modules/semver/package.json

Dependency Hierarchy:

  • akismet-api-5.3.0.tgz (Root Library)
    • superagent-7.1.3.tgz
      • ❌ semver-7.3.7.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

⛑️Automatic Remediation will be attempted for this issue.

storage-blob-12.12.0.tgz: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - storage-blob-12.12.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/core-http/node_modules/tough-cookie/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (storage-blob version) Remediation Possible**
CVE-2023-26136 Medium 6.5 tough-cookie-4.0.0.tgz Transitive 12.13.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26136

Vulnerable Library - tough-cookie-4.0.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/core-http/node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • storage-blob-12.12.0.tgz (Root Library)
    • core-http-2.2.4.tgz
      • ❌ tough-cookie-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (@azure/storage-blob): 12.13.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

azure-search-client-3.1.5.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - azure-search-client-3.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/node_modules/qs/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (azure-search-client version) Remediation Possible**
CVE-2022-24999 High 7.5 qs-6.8.0.tgz Transitive N/A* ❌
CVE-2022-25901 Medium 5.3 cookiejar-2.1.2.tgz Transitive N/A* ❌
CVE-2017-16137 Low 3.7 debug-3.2.6.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24999

Vulnerable Library - qs-6.8.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/node_modules/qs/package.json

Dependency Hierarchy:

  • azure-search-client-3.1.5.tgz (Root Library)
    • superagent-3.8.3.tgz
      • ❌ qs-6.8.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution: qs - 6.2.4,6.3.3,6.4.1,6.5.3,6.6.1,6.7.3,6.8.3,6.9.7,6.10.3

CVE-2022-25901

Vulnerable Library - cookiejar-2.1.2.tgz

simple persistent cookiejar system

Library home page: https://registry.npmjs.org/cookiejar/-/cookiejar-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cookiejar/package.json

Dependency Hierarchy:

  • azure-search-client-3.1.5.tgz (Root Library)
    • superagent-3.8.3.tgz
      • ❌ cookiejar-2.1.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an insecure regular expression.

Publish Date: 2023-01-18

URL: CVE-2022-25901

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-01-18

Fix Resolution: cookiejar - 2.1.4

CVE-2017-16137

Vulnerable Library - debug-3.2.6.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-3.2.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/node_modules/debug/package.json

Dependency Hierarchy:

  • azure-search-client-3.1.5.tgz (Root Library)
    • superagent-3.8.3.tgz
      • ❌ debug-3.2.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-04-26

URL: CVE-2017-16137

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution: debug - 2.6.9,3.1.0,3.2.7,4.3.1

apollo-server-express-2.25.2.tgz: 7 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - apollo-server-express-2.25.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/node_modules/qs/package.json,/node_modules/apollo-server-express/node_modules/qs/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (apollo-server-express version) Remediation Possible**
CVE-2024-45296 High 7.5 path-to-regexp-0.1.7.tgz Transitive 3.0.0 ✅
CVE-2024-37890 High 7.5 ws-7.5.6.tgz Transitive 2.25.3 ✅
CVE-2022-24999 High 7.5 qs-6.7.0.tgz Transitive 2.25.3 ✅
CVE-2024-29041 Medium 6.1 express-4.17.1.tgz Transitive 3.0.0 ✅
WS-2023-0313 Medium 5.3 apollo-server-core-2.25.3.tgz Transitive 2.25.3 ✅
CVE-2024-43799 Medium 5.0 send-0.17.1.tgz Transitive N/A* ❌
CVE-2024-43796 Medium 5.0 express-4.17.1.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-45296

Vulnerable Library - path-to-regexp-0.1.7.tgz

Express style path to RegExp utility

Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-to-regexp/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • express-4.17.1.tgz
      • ❌ path-to-regexp-0.1.7.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.

Publish Date: 2024-09-09

URL: CVE-2024-45296

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9wv6-86v2-598j

Release Date: 2024-09-09

Fix Resolution (path-to-regexp): 0.1.10

Direct dependency fix Resolution (apollo-server-express): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-37890

Vulnerable Library - ws-7.5.6.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.5.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server-express/node_modules/ws/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • subscriptions-transport-ws-0.9.19.tgz
      • ❌ ws-7.5.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in [email protected] (e55e510) and backported to [email protected] (22c2876), [email protected] (eeb76d3), and [email protected] (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (apollo-server-express): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/node_modules/qs/package.json,/node_modules/apollo-server-express/node_modules/qs/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • express-4.17.1.tgz
      • ❌ qs-6.7.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (apollo-server-express): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29041

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/node_modules/express/package.json,/node_modules/apollo-server-express/node_modules/express/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • ❌ express-4.17.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution (express): 4.19.0

Direct dependency fix Resolution (apollo-server-express): 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2023-0313

Vulnerable Library - apollo-server-core-2.25.3.tgz

Core engine for Apollo GraphQL server

Library home page: https://registry.npmjs.org/apollo-server-core/-/apollo-server-core-2.25.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server-core/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • ❌ apollo-server-core-2.25.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Apollo Server can log sensitive information (Studio API keys) if they are passed incorrectly (with leading/trailing whitespace) or if they have any characters that are invalid as part of a header value.

Publish Date: 2023-08-31

URL: WS-2023-0313

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j5g3-5c8r-7qfx

Release Date: 2023-08-31

Fix Resolution (apollo-server-core): 2.26.1

Direct dependency fix Resolution (apollo-server-express): 2.25.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-43799

Vulnerable Library - send-0.17.1.tgz

Better streaming static file server with Range and conditional-GET support

Library home page: https://registry.npmjs.org/send/-/send-0.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/send/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • express-4.17.1.tgz
      • ❌ send-0.17.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.

Publish Date: 2024-09-10

URL: CVE-2024-43799

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-m6fv-jmcg-4jfg

Release Date: 2024-09-10

Fix Resolution: send - 0.19.0

CVE-2024-43796

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/apollo-server/node_modules/express/package.json,/node_modules/apollo-server-express/node_modules/express/package.json

Dependency Hierarchy:

  • apollo-server-express-2.25.2.tgz (Root Library)
    • ❌ express-4.17.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

Publish Date: 2024-09-10

URL: CVE-2024-43796

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qw6h-vgh9-j6wx

Release Date: 2024-09-10

Fix Resolution: express - 4.20.0,5.0.0

⛑️Automatic Remediation will be attempted for this issue.

connect-session-knex-2.0.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - connect-session-knex-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/connect-session-knex/node_modules/knex/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (connect-session-knex version) Remediation Possible**
CVE-2016-20018 High 7.5 knex-0.21.6.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2016-20018

Vulnerable Library - knex-0.21.6.tgz

A batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser

Library home page: https://registry.npmjs.org/knex/-/knex-0.21.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/connect-session-knex/node_modules/knex/package.json

Dependency Hierarchy:

  • connect-session-knex-2.0.0.tgz (Root Library)
    • ❌ knex-0.21.6.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.

Publish Date: 2022-12-19

URL: CVE-2016-20018

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

mysql2-3.1.0.tgz: 5 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mysql2 version) Remediation Possible**
CVE-2024-21511 Critical 9.8 mysql2-3.1.0.tgz Direct 3.9.7 ✅
CVE-2024-21508 Critical 9.8 mysql2-3.1.0.tgz Direct 3.9.4 ✅
CVE-2024-21512 High 8.2 mysql2-3.1.0.tgz Direct 3.9.8 ✅
CVE-2024-21509 Medium 6.5 mysql2-3.1.0.tgz Direct 3.9.4 ✅
CVE-2024-21507 Medium 6.5 mysql2-3.1.0.tgz Direct 3.9.3 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21511

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Dependency Hierarchy:

  • ❌ mysql2-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parameter in the readCodeFor function by calling a native MySQL Server date/time function.

Publish Date: 2024-04-23

URL: CVE-2024-21511

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21511

Release Date: 2024-04-23

Fix Resolution: 3.9.7

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21508

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Dependency Hierarchy:

  • ❌ mysql2-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validation of the supportBigNumbers and bigNumberStrings values.

Publish Date: 2024-04-11

URL: CVE-2024-21508

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21508

Release Date: 2024-04-11

Fix Resolution: 3.9.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21512

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Dependency Hierarchy:

  • ❌ mysql2-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields and tables when using nestTables.

Publish Date: 2024-05-29

URL: CVE-2024-21512

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-29

Fix Resolution: 3.9.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21509

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Dependency Hierarchy:

  • ❌ mysql2-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user input sanitization passed through parserFn in text_parser.js and binary_parser.js.

Publish Date: 2024-04-10

URL: CVE-2024-21509

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21509

Release Date: 2024-04-10

Fix Resolution: 3.9.4

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21507

Vulnerable Library - mysql2-3.1.0.tgz

Library home page: https://registry.npmjs.org/mysql2/-/mysql2-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mysql2/package.json

Dependency Hierarchy:

  • ❌ mysql2-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cache poisoning. An attacker can inject a colon (:) character within a value of the attacker-crafted key.

Publish Date: 2024-04-10

URL: CVE-2024-21507

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21507

Release Date: 2024-04-10

Fix Resolution: 3.9.3

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

winston-3.8.2.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - winston-3.8.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (winston version) Remediation Possible**
WS-2021-0152 High 7.5 color-string-1.5.3.tgz Transitive 3.9.0 ✅
CVE-2021-29060 Medium 5.3 color-string-1.5.3.tgz Transitive 3.9.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2021-0152

Vulnerable Library - color-string-1.5.3.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • winston-3.8.2.tgz (Root Library)
    • diagnostics-2.0.2.tgz
      • colorspace-1.1.2.tgz
        • color-3.0.0.tgz
          • ❌ color-string-1.5.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-12

Fix Resolution (color-string): 1.5.5

Direct dependency fix Resolution (winston): 3.9.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-29060

Vulnerable Library - color-string-1.5.3.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • winston-3.8.2.tgz (Root Library)
    • diagnostics-2.0.2.tgz
      • colorspace-1.1.2.tgz
        • color-3.0.0.tgz
          • ❌ color-string-1.5.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Publish Date: 2021-06-21

URL: CVE-2021-29060

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-257v-vj4p-3w2h

Release Date: 2021-06-21

Fix Resolution (color-string): 1.5.5

Direct dependency fix Resolution (winston): 3.9.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

highlight.js-10.3.1.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - highlight.js-10.3.1.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-10.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/highlight.js/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (highlight.js version) Remediation Possible**
WS-2020-0208 Medium 5.3 highlight.js-10.3.1.tgz Direct 10.4.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2020-0208

Vulnerable Library - highlight.js-10.3.1.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-10.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/highlight.js/package.json

Dependency Hierarchy:

  • ❌ highlight.js-10.3.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.

Publish Date: 2020-12-04

URL: WS-2020-0208

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-12-04

Fix Resolution: 10.4.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

passport-cas-0.1.1.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - passport-cas-0.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-uuid/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-cas version) Remediation Possible**
CVE-2015-8851 High 7.5 node-uuid-1.4.1.tgz Transitive N/A* ❌
CVE-2023-0842 Medium 5.3 xml2js-0.4.4.tgz Transitive N/A* ❌
CVE-2021-23358 Low 3.3 underscore-1.6.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2015-8851

Vulnerable Library - node-uuid-1.4.1.tgz

Rigorous implementation of RFC4122 (v1 and v4) UUIDs.

Library home page: https://registry.npmjs.org/node-uuid/-/node-uuid-1.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-uuid/package.json

Dependency Hierarchy:

  • passport-cas-0.1.1.tgz (Root Library)
    • ❌ node-uuid-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-uuid before 1.4.4 uses insufficiently random data to create a GUID, which could make it easier for attackers to have unspecified impact via brute force guessing.
Mend Note: Converted from WS-2016-0013, on 2022-11-08.

Publish Date: 2020-01-30

URL: CVE-2015-8851

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/93

Release Date: 2020-01-30

Fix Resolution: 1.4.4

CVE-2023-0842

Vulnerable Library - xml2js-0.4.4.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-cas/node_modules/xml2js/package.json

Dependency Hierarchy:

  • passport-cas-0.1.1.tgz (Root Library)
    • ❌ xml2js-0.4.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution: xml2js - 0.5.0

CVE-2021-23358

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-cas/node_modules/underscore/package.json

Dependency Hierarchy:

  • passport-cas-0.1.1.tgz (Root Library)
    • ❌ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2

request-2.88.2.tgz: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (request version) Remediation Possible**
CVE-2021-3918 Critical 9.8 json-schema-0.2.3.tgz Transitive N/A* ❌
CVE-2023-28155 Medium 6.1 request-2.88.2.tgz Direct @cypress/request - 3.0.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy:

  • request-2.88.2.tgz (Root Library)
    • http-signature-1.2.0.tgz
      • jsprim-1.4.1.tgz
        • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution: json-schema - 0.4.0

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

  • ❌ request-2.88.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

passport-google-oauth20-2.0.0.tgz: 1 vulnerabilities (highest severity is: 5.3) - autoclosed

Vulnerable Library - passport-google-oauth20-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-google-oauth20/node_modules/passport-oauth2/package.json,/node_modules/passport-discord/node_modules/passport-oauth2/package.json,/node_modules/passport-twitch-strategy/node_modules/passport-oauth2/package.json,/node_modules/passport-github2/node_modules/passport-oauth2/package.json,/node_modules/passport-gitlab2/node_modules/passport-oauth2/package.json,/node_modules/@exlinc/keycloak-passport/node_modules/passport-oauth2/package.json,/node_modules/passport-facebook/node_modules/passport-oauth2/package.json,/node_modules/passport-oauth/node_modules/passport-oauth2/package.json,/node_modules/passport-slack-oauth2/node_modules/passport-oauth2/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-google-oauth20 version) Remediation Possible**
CVE-2021-41580 Medium 5.3 passport-oauth2-1.5.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-41580

Vulnerable Library - passport-oauth2-1.5.0.tgz

OAuth 2.0 authentication strategy for Passport.

Library home page: https://registry.npmjs.org/passport-oauth2/-/passport-oauth2-1.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport-google-oauth20/node_modules/passport-oauth2/package.json,/node_modules/passport-discord/node_modules/passport-oauth2/package.json,/node_modules/passport-twitch-strategy/node_modules/passport-oauth2/package.json,/node_modules/passport-github2/node_modules/passport-oauth2/package.json,/node_modules/passport-gitlab2/node_modules/passport-oauth2/package.json,/node_modules/@exlinc/keycloak-passport/node_modules/passport-oauth2/package.json,/node_modules/passport-facebook/node_modules/passport-oauth2/package.json,/node_modules/passport-oauth/node_modules/passport-oauth2/package.json,/node_modules/passport-slack-oauth2/node_modules/passport-oauth2/package.json

Dependency Hierarchy:

  • passport-google-oauth20-2.0.0.tgz (Root Library)
    • ❌ passport-oauth2-1.5.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

** DISPUTED ** The passport-oauth2 package before 1.6.1 for Node.js mishandles the error condition of failure to obtain an access token. This is exploitable in certain use cases where an OAuth identity provider uses an HTTP 200 status code for authentication-failure error reports, and an application grants authorization upon simply receiving the access token (i.e., does not try to use the token). NOTE: the passport-oauth2 vendor does not consider this a passport-oauth2 vulnerability.

Publish Date: 2021-09-27

URL: CVE-2021-41580

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41580

Release Date: 2021-09-27

Fix Resolution: passport-oauth2 - 1.6.1

passport-azure-ad-4.3.4.tgz: 10 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - passport-azure-ad-4.3.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport-azure-ad version) Remediation Possible**
CVE-2021-44906 Critical 9.8 minimist-0.0.8.tgz Transitive 4.3.5 ✅
CVE-2023-25653 High 7.5 node-jose-2.0.0.tgz Transitive 4.3.5 ✅
CVE-2022-31129 High 7.5 moment-2.27.0.tgz Transitive 4.3.5 ✅
CVE-2022-24785 High 7.5 moment-2.27.0.tgz Transitive 4.3.5 ✅
CVE-2022-24772 High 7.5 node-forge-0.10.0.tgz Transitive 4.3.5 ✅
CVE-2022-24771 High 7.5 node-forge-0.10.0.tgz Transitive 4.3.5 ✅
WS-2022-0008 Medium 6.6 node-forge-0.10.0.tgz Transitive 4.3.5 ✅
CVE-2022-0122 Medium 6.1 node-forge-0.10.0.tgz Transitive 4.3.5 ✅
CVE-2020-7598 Medium 5.6 minimist-0.0.8.tgz Transitive 4.3.5 ✅
CVE-2022-24773 Medium 5.3 node-forge-0.10.0.tgz Transitive 4.3.5 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-44906

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • bunyan-1.8.14.tgz
      • mv-2.1.1.tgz
        • mkdirp-0.5.1.tgz
          • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 0.2.4

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-25653

Vulnerable Library - node-jose-2.0.0.tgz

A JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for current web browsers and node.js-based servers

Library home page: https://registry.npmjs.org/node-jose/-/node-jose-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-jose/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • ❌ node-jose-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-jose is a JavaScript implementation of the JSON Object Signing and Encryption (JOSE) for web browsers and node.js-based servers. Prior to version 2.2.0, when using the non-default "fallback" crypto back-end, ECC operations in node-jose can trigger a Denial-of-Service (DoS) condition, due to a possible infinite loop in an internal calculation. For some ECC operations, this condition is triggered randomly; for others, it can be triggered by malicious input. The issue has been patched in version 2.2.0. Since this issue is only present in the "fallback" crypto implementation, it can be avoided by ensuring that either WebCrypto or the Node crypto module is available in the JS environment where node-jose is being run.

Publish Date: 2023-02-16

URL: CVE-2023-25653

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5h4j-qrvg-9xhw

Release Date: 2023-02-16

Fix Resolution (node-jose): 2.2.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-31129

Vulnerable Library - moment-2.27.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.27.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bunyan/node_modules/moment/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • bunyan-1.8.14.tgz
      • ❌ moment-2.27.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution (moment): 2.29.4

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24785

Vulnerable Library - moment-2.27.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.27.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/bunyan/node_modules/moment/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • bunyan-1.8.14.tgz
      • ❌ moment-2.27.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24772

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • node-jose-2.0.0.tgz
      • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24771

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • node-jose-2.0.0.tgz
      • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

WS-2022-0008

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • node-jose-2.0.0.tgz
      • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0122

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • node-jose-2.0.0.tgz
      • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site
Mend Note: Converted from WS-2022-0007, on 2022-11-07.

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7598

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • bunyan-1.8.14.tgz
      • mv-2.1.1.tgz
        • mkdirp-0.5.1.tgz
          • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24773

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • passport-azure-ad-4.3.4.tgz (Root Library)
    • node-jose-2.0.0.tgz
      • ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check DigestInfo for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (passport-azure-ad): 4.3.5

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

moment-timezone-0.5.40.tgz: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - moment-timezone-0.5.40.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/node_modules/moment/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (moment-timezone version) Remediation Possible**
CVE-2022-31129 High 7.5 moment-2.24.0.tgz Transitive 0.5.41 ✅
CVE-2022-24785 High 7.5 moment-2.24.0.tgz Transitive 0.5.41 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31129

Vulnerable Library - moment-2.24.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.24.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/node_modules/moment/package.json

Dependency Hierarchy:

  • moment-timezone-0.5.40.tgz (Root Library)
    • ❌ moment-2.24.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution (moment): 2.29.4

Direct dependency fix Resolution (moment-timezone): 0.5.41

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24785

Vulnerable Library - moment-2.24.0.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.24.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment-timezone/node_modules/moment/package.json

Dependency Hierarchy:

  • moment-timezone-0.5.40.tgz (Root Library)
    • ❌ moment-2.24.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (moment-timezone): 0.5.41

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

markdown-it-decorate-1.2.2.tgz: 1 vulnerabilities (highest severity is: 7.3)

Vulnerable Library - markdown-it-decorate-1.2.2.tgz

Add classes, identifiers and attributes to your markdown with HTML comments

Library home page: https://registry.npmjs.org/markdown-it-decorate/-/markdown-it-decorate-1.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/markdown-it-decorate/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (markdown-it-decorate version) Remediation Possible**
CVE-2020-28459 High 7.3 markdown-it-decorate-1.2.2.tgz Direct N/A ❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-28459

Vulnerable Library - markdown-it-decorate-1.2.2.tgz

Add classes, identifiers and attributes to your markdown with HTML comments

Library home page: https://registry.npmjs.org/markdown-it-decorate/-/markdown-it-decorate-1.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/markdown-it-decorate/package.json

Dependency Hierarchy:

  • ❌ markdown-it-decorate-1.2.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects all versions of package markdown-it-decorate. An attacker can add an event handler or use javascript:xxx for the link.

Publish Date: 2022-07-25

URL: CVE-2020-28459

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

luxon-1.25.0.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - luxon-1.25.0.tgz

Immutable date wrapper

Library home page: https://registry.npmjs.org/luxon/-/luxon-1.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/luxon/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (luxon version) Remediation Possible**
CVE-2023-22467 High 7.5 luxon-1.25.0.tgz Direct 1.28.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-22467

Vulnerable Library - luxon-1.25.0.tgz

Immutable date wrapper

Library home page: https://registry.npmjs.org/luxon/-/luxon-1.25.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/luxon/package.json

Dependency Hierarchy:

  • ❌ luxon-1.25.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Luxon is a library for working with dates and times in JavaScript. On the 1.x branch prior to 1.38.1, the 2.x branch prior to 2.5.2, and the 3.x branch on 3.2.1, Luxon's `DateTime.fromRFC2822() has quadratic (N^2) complexity on some specific inputs. This causes a noticeable slowdown for inputs with lengths above 10k characters. Users providing untrusted data to this method are therefore vulnerable to (Re)DoS attacks. This issue also appears in Moment as CVE-2022-31129. Versions 1.38.1, 2.5.2, and 3.2.1 contain patches for this issue. As a workaround, limit the length of the input.

Publish Date: 2023-01-04

URL: CVE-2023-22467

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3xq5-wjfh-ppjc

Release Date: 2023-01-04

Fix Resolution: 1.28.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

simple-git-3.16.0.tgz: 1 vulnerabilities (highest severity is: 3.7) - autoclosed

Vulnerable Library - simple-git-3.16.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@kwsites/file-exists/node_modules/debug/package.json,/node_modules/strtok3/node_modules/debug/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (simple-git version) Remediation Possible**
CVE-2017-16137 Low 3.7 debug-4.2.0.tgz Transitive 3.16.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2017-16137

Vulnerable Library - debug-4.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-4.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@kwsites/file-exists/node_modules/debug/package.json,/node_modules/strtok3/node_modules/debug/package.json

Dependency Hierarchy:

  • simple-git-3.16.0.tgz (Root Library)
    • file-exists-1.1.1.tgz
      • ❌ debug-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gxpj-cx7g-858c

Release Date: 2018-04-26

Fix Resolution (debug): 4.3.1

Direct dependency fix Resolution (simple-git): 3.16.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

aws-sdk-2.1309.0.tgz: 1 vulnerabilities (highest severity is: 5.3) - autoclosed

Vulnerable Library - aws-sdk-2.1309.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/aws-sdk/node_modules/xml2js/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (aws-sdk version) Remediation Possible**
CVE-2023-0842 Medium 5.3 xml2js-0.4.19.tgz Transitive 2.1354.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-0842

Vulnerable Library - xml2js-0.4.19.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/aws-sdk/node_modules/xml2js/package.json

Dependency Hierarchy:

  • aws-sdk-2.1309.0.tgz (Root Library)
    • ❌ xml2js-0.4.19.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution (xml2js): 0.5.0

Direct dependency fix Resolution (aws-sdk): 2.1354.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

solr-node-1.2.1.tgz: 3 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - solr-node-1.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (solr-node version) Remediation Possible**
CVE-2022-0235 Medium 6.1 node-fetch-2.6.0.tgz Transitive N/A* ❌
CVE-2021-23358 Low 3.3 underscore-1.9.1.tgz Transitive N/A* ❌
CVE-2020-15168 Low 2.6 node-fetch-2.6.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-0235

Vulnerable Library - node-fetch-2.6.0.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/solr-node/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • solr-node-1.2.1.tgz (Root Library)
    • ❌ node-fetch-2.6.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution: node-fetch - 2.6.7,3.1.1

CVE-2021-23358

Vulnerable Library - underscore-1.9.1.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.9.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Dependency Hierarchy:

  • solr-node-1.2.1.tgz (Root Library)
    • ❌ underscore-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2

CVE-2020-15168

Vulnerable Library - node-fetch-2.6.0.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/solr-node/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • solr-node-1.2.1.tgz (Root Library)
    • ❌ node-fetch-2.6.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Publish Date: 2020-09-10

URL: CVE-2020-15168

CVSS 3 Score Details (2.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7rc-rwvf-8q5r

Release Date: 2020-09-17

Fix Resolution: 2.6.1,3.0.0-beta.9

mongodb-3.6.5.tgz: 1 vulnerabilities (highest severity is: 4.2)

Vulnerable Library - mongodb-3.6.5.tgz

The official MongoDB driver for Node.js

Library home page: https://registry.npmjs.org/mongodb/-/mongodb-3.6.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongodb/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mongodb version) Remediation Possible**
CVE-2021-32050 Medium 4.2 mongodb-3.6.5.tgz Direct mongodb - 3.6.10,4.17.0,5.8.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-32050

Vulnerable Library - mongodb-3.6.5.tgz

The official MongoDB driver for Node.js

Library home page: https://registry.npmjs.org/mongodb/-/mongodb-3.6.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mongodb/package.json

Dependency Hierarchy:

  • ❌ mongodb-3.6.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Some MongoDB Drivers may erroneously publish events containing authentication-related data to a command listener configured by an application. The published events may contain security-sensitive data when specific authentication-related commands are executed.

Without due care, an application may inadvertently expose this sensitive information, e.g., by writing it to a log file. This issue only arises if an application enables the command listener feature (this is not enabled by default).

This issue affects the MongoDB C Driver 1.0.0 prior to 1.17.7, MongoDB PHP Driver 1.0.0 prior to 1.9.2, MongoDB Swift Driver 1.0.0 prior to 1.1.1, MongoDB Node.js Driver 3.6 prior to 3.6.10, MongoDB Node.js Driver 4.0 prior to 4.17.0 and MongoDB Node.js Driver 5.0 prior to 5.8.0. This issue also affects users of the MongoDB C++ Driver dependent on the C driver 1.0.0 prior to 1.17.7 (C++ driver prior to 3.7.0).

Publish Date: 2023-08-29

URL: CVE-2021-32050

CVSS 3 Score Details (4.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-vxvm-qww3-2fh7

Release Date: 2023-08-29

Fix Resolution: mongodb - 3.6.10,4.17.0,5.8.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

knex-0.21.7.tgz: 6 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - knex-0.21.7.tgz

A batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser

Library home page: https://registry.npmjs.org/knex/-/knex-0.21.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/knex/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (knex version) Remediation Possible**
CVE-2024-4068 High 7.5 braces-2.3.2.tgz Transitive N/A* ❌
CVE-2022-38900 High 7.5 decode-uri-component-0.2.0.tgz Transitive 0.21.8 ✅
CVE-2019-20149 High 7.5 kind-of-6.0.2.tgz Transitive 0.21.8 ✅
CVE-2016-20018 High 7.5 knex-0.21.7.tgz Direct N/A ❌
CVE-2020-7788 High 7.3 ini-1.3.5.tgz Transitive 0.21.8 ✅
CVE-2024-4067 Medium 5.3 micromatch-3.1.10.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-2.3.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-2.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/braces/package.json

Dependency Hierarchy:

  • knex-0.21.7.tgz (Root Library)
    • liftoff-3.1.0.tgz
      • findup-sync-3.0.0.tgz
        • micromatch-3.1.10.tgz
          • ❌ braces-2.3.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-13

URL: CVE-2024-4068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: braces - 3.0.3

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • knex-0.21.7.tgz (Root Library)
    • liftoff-3.1.0.tgz
      • findup-sync-3.0.0.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • source-map-resolve-0.5.2.tgz
              • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (knex): 0.21.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2019-20149

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/kind-of/package.json

Dependency Hierarchy:

  • knex-0.21.7.tgz (Root Library)
    • liftoff-3.1.0.tgz
      • object.map-1.0.1.tgz
        • make-iterator-1.0.1.tgz
          • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-12-30

Fix Resolution (kind-of): 6.0.3

Direct dependency fix Resolution (knex): 0.21.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2016-20018

Vulnerable Library - knex-0.21.7.tgz

A batteries-included SQL query & schema builder for Postgres, MySQL and SQLite3 and the Browser

Library home page: https://registry.npmjs.org/knex/-/knex-0.21.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/knex/package.json

Dependency Hierarchy:

  • ❌ knex-0.21.7.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.

Publish Date: 2022-12-19

URL: CVE-2016-20018

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2020-7788

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ini/package.json

Dependency Hierarchy:

  • knex-0.21.7.tgz (Root Library)
    • liftoff-3.1.0.tgz
      • findup-sync-3.0.0.tgz
        • resolve-dir-1.0.1.tgz
          • global-modules-1.0.0.tgz
            • global-prefix-1.0.2.tgz
              • ❌ ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (knex): 0.21.8

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4067

Vulnerable Library - micromatch-3.1.10.tgz

Glob matching for javascript/node.js. A drop-in replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/findup-sync/node_modules/micromatch/package.json

Dependency Hierarchy:

  • knex-0.21.7.tgz (Root Library)
    • liftoff-3.1.0.tgz
      • findup-sync-3.0.0.tgz
        • ❌ micromatch-3.1.10.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The NPM package micromatch prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 should not reflect the security risk score in NVD, but will be kept for users' awareness.

Publish Date: 2024-05-13

URL: CVE-2024-4067

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-13

Fix Resolution: micromatch - 4.0.8

⛑️Automatic Remediation will be attempted for this issue.

passport-0.4.1.tgz: 1 vulnerabilities (highest severity is: 4.8) - autoclosed

Vulnerable Library - passport-0.4.1.tgz

Simple, unobtrusive authentication for Node.js.

Library home page: https://registry.npmjs.org/passport/-/passport-0.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (passport version) Remediation Possible**
CVE-2022-25896 Medium 4.8 passport-0.4.1.tgz Direct 0.6.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25896

Vulnerable Library - passport-0.4.1.tgz

Simple, unobtrusive authentication for Node.js.

Library home page: https://registry.npmjs.org/passport/-/passport-0.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/passport/package.json

Dependency Hierarchy:

  • ❌ passport-0.4.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.

Publish Date: 2022-07-01

URL: CVE-2022-25896

CVSS 3 Score Details (4.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25896

Release Date: 2022-07-01

Fix Resolution: 0.6.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

i18next-node-fs-backend-2.1.3.tgz: 3 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - i18next-node-fs-backend-2.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/i18next-node-fs-backend/node_modules/json5/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (i18next-node-fs-backend version) Remediation Possible**
CVE-2021-44906 Critical 9.8 minimist-1.2.0.tgz Transitive N/A* ❌
CVE-2022-46175 High 7.1 json5-2.0.0.tgz Transitive N/A* ❌
CVE-2020-7598 Medium 5.6 minimist-1.2.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-44906

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • i18next-node-fs-backend-2.1.3.tgz (Root Library)
    • json5-2.0.0.tgz
      • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution: minimist - 0.2.4,1.2.6

CVE-2022-46175

Vulnerable Library - json5-2.0.0.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/i18next-node-fs-backend/node_modules/json5/package.json

Dependency Hierarchy:

  • i18next-node-fs-backend-2.1.3.tgz (Root Library)
    • ❌ json5-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

CVE-2020-7598

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • i18next-node-fs-backend-2.1.3.tgz (Root Library)
    • json5-2.0.0.tgz
      • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

sqlite3-5.1.4.tgz: 12 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - sqlite3-5.1.4.tgz

Library home page: https://registry.npmjs.org/sqlite3/-/sqlite3-5.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sqlite3/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (sqlite3 version) Remediation Possible**
CVE-2023-42282 Critical 9.8 ip-1.1.5.tgz Transitive 5.1.5 ✅
CVE-2024-29415 Critical 9.1 ip-1.1.5.tgz Transitive N/A* ❌
CVE-2021-37713 High 8.2 tar-6.0.2.tgz Transitive 5.1.5 ✅
CVE-2021-37712 High 8.2 tar-6.0.2.tgz Transitive 5.1.5 ✅
CVE-2021-37701 High 8.2 tar-6.0.2.tgz Transitive 5.1.5 ✅
CVE-2021-32804 High 8.2 tar-6.0.2.tgz Transitive 5.1.5 ✅
CVE-2021-32803 High 8.2 tar-6.0.2.tgz Transitive 5.1.5 ✅
CVE-2022-43441 High 8.1 sqlite3-5.1.4.tgz Direct 5.1.5 ✅
CVE-2021-27290 High 7.5 ssri-8.0.0.tgz Transitive 5.1.5 ✅
CVE-2024-28863 Medium 6.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-25883 Medium 5.3 semver-6.3.0.tgz Transitive N/A* ❌
CVE-2022-25881 Medium 5.3 http-cache-semantics-4.1.0.tgz Transitive 5.1.5 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-42282

Vulnerable Library - ip-1.1.5.tgz

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • socks-proxy-agent-6.2.0.tgz
          • socks-2.6.2.tgz
            • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29415

Vulnerable Library - ip-1.1.5.tgz

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • socks-proxy-agent-6.2.0.tgz
          • socks-2.6.2.tgz
            • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Publish Date: 2024-05-27

URL: CVE-2024-29415

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2021-37713

Vulnerable Library - tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 6.1.9

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37712

Vulnerable Library - tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 6.1.9

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37701

Vulnerable Library - tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 6.1.7

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32804

Vulnerable Library - tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 6.1.1

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32803

Vulnerable Library - tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 6.1.2

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-43441

Vulnerable Library - sqlite3-5.1.4.tgz

Library home page: https://registry.npmjs.org/sqlite3/-/sqlite3-5.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sqlite3/package.json

Dependency Hierarchy:

  • ❌ sqlite3-5.1.4.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Publish Date: 2023-03-16

URL: CVE-2022-43441

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jqv5-7xpx-qj74

Release Date: 2023-03-16

Fix Resolution: 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-27290

Vulnerable Library - ssri-8.0.0.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-8.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ssri/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • ❌ ssri-8.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Publish Date: 2021-03-12

URL: CVE-2021-27290

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vx3p-948g-6vhq

Release Date: 2021-03-12

Fix Resolution (ssri): 8.0.1

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28863

Vulnerable Libraries - tar-6.1.11.tgz, tar-6.0.2.tgz

tar-6.1.11.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • ❌ tar-6.1.11.tgz (Vulnerable Library)

tar-6.0.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cacache/node_modules/tar/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • cacache-15.3.0.tgz
          • ❌ tar-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

Publish Date: 2024-03-21

URL: CVE-2024-28863

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f5x3-32g6-xq36

Release Date: 2024-03-21

Fix Resolution: tar - 6.2.1

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/make-dir/node_modules/semver/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-pre-gyp-1.0.9.tgz
      • make-dir-3.1.0.tgz
        • ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution: semver - 5.7.2,6.3.1,7.5.2;org.webjars.npm:semver:7.5.2

CVE-2022-25881

Vulnerable Library - http-cache-semantics-4.1.0.tgz

Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies

Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-cache-semantics/package.json

Dependency Hierarchy:

  • sqlite3-5.1.4.tgz (Root Library)
    • node-gyp-8.4.1.tgz
      • make-fetch-happen-9.1.0.tgz
        • ❌ http-cache-semantics-4.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.

Publish Date: 2023-01-31

URL: CVE-2022-25881

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rc47-6667-2j5j

Release Date: 2023-01-31

Fix Resolution (http-cache-semantics): 4.1.1

Direct dependency fix Resolution (sqlite3): 5.1.5

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

mssql-6.2.3.tgz: 17 vulnerabilities (highest severity is: 9.4)

Vulnerable Library - mssql-6.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/adal-node/node_modules/async/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (mssql version) Remediation Possible**
CVE-2022-39353 Critical 9.4 xmldom-0.1.27.tgz Transitive N/A* ❌
CVE-2021-43138 High 7.8 async-3.1.0.tgz Transitive 6.3.0 ✅
CVE-2021-28458 High 7.8 ms-rest-nodeauth-2.0.2.tgz Transitive 6.3.0 ✅
CVE-2021-3749 High 7.5 axios-0.19.0.tgz Transitive 6.3.0 ✅
CVE-2023-26159 High 7.3 follow-redirects-1.5.10.tgz Transitive 6.3.0 ✅
CVE-2024-28849 Medium 6.5 follow-redirects-1.5.10.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 axios-0.19.0.tgz Transitive 6.3.0 ✅
CVE-2023-26136 Medium 6.5 tough-cookie-2.4.3.tgz Transitive 6.3.0 ✅
CVE-2022-0155 Medium 6.5 follow-redirects-1.5.10.tgz Transitive 6.3.0 ✅
CVE-2021-32796 Medium 6.5 xmldom-0.1.27.tgz Transitive N/A* ❌
CVE-2020-8244 Medium 6.5 bl-3.0.0.tgz Transitive 6.3.0 ✅
CVE-2023-28155 Medium 6.1 request-2.88.0.tgz Transitive N/A* ❌
CVE-2020-28168 Medium 5.9 axios-0.19.0.tgz Transitive 6.3.0 ✅
CVE-2020-15366 Medium 5.6 ajv-6.10.2.tgz Transitive 6.3.0 ✅
CVE-2023-0842 Medium 5.3 xml2js-0.4.22.tgz Transitive 6.3.0 ✅
CVE-2021-21366 Medium 4.3 xmldom-0.1.27.tgz Transitive 6.3.0 ✅
CVE-2022-0536 Low 2.6 follow-redirects-1.5.10.tgz Transitive 6.3.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-39353

Vulnerable Library - xmldom-0.1.27.tgz

A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).

Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.27.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xmldom/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • ❌ xmldom-0.1.27.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom parses XML that is not well-formed because it contains multiple top level elements, and adds all root nodes to the childNodes collection of the Document, without reporting any error or throwing. This breaks the assumption that there is only a single root node in the tree, which led to issuance of CVE-2022-39299 as it is a potential issue for dependents. Update to @xmldom/xmldom@~0.7.7, @xmldom/xmldom@~0.8.4 (dist-tag latest) or @xmldom/xmldom@>=0.9.0-beta.4 (dist-tag next). As a workaround, please one of the following approaches depending on your use case: instead of searching for elements in the whole DOM, only search in the documentElementor reject a document with a document that has more then 1 childNode.

Publish Date: 2022-11-02

URL: CVE-2022-39353

CVSS 3 Score Details (9.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crh6-fp67-6883

Release Date: 2022-11-02

Fix Resolution: @xmldom/xmldom - 0.7.7,0.8.4

CVE-2021-43138

Vulnerable Library - async-3.1.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/adal-node/node_modules/async/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • ❌ async-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 3.2.2

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-28458

Vulnerable Library - ms-rest-nodeauth-2.0.2.tgz

Azure Authentication library in node.js with type definitions.

Library home page: https://registry.npmjs.org/@azure/ms-rest-nodeauth/-/ms-rest-nodeauth-2.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-nodeauth/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ❌ ms-rest-nodeauth-2.0.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Azure ms-rest-nodeauth Library Elevation of Privilege Vulnerability

Publish Date: 2021-04-13

URL: CVE-2021-28458

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-04-13

Fix Resolution (@azure/ms-rest-nodeauth): 3.0.8

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3749

Vulnerable Library - axios-0.19.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/axios/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • ❌ axios-0.19.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution (axios): 0.20.0

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26159

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • axios-0.19.0.tgz
            • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28849

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • axios-0.19.0.tgz
            • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2023-45857

Vulnerable Library - axios-0.19.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/axios/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • ❌ axios-0.19.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution (axios): 0.20.0

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26136

Vulnerable Library - tough-cookie-2.4.3.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/adal-node/node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • request-2.88.0.tgz
            • ❌ tough-cookie-2.4.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • axios-0.19.0.tgz
            • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32796

Vulnerable Library - xmldom-0.1.27.tgz

A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).

Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.27.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xmldom/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • ❌ xmldom-0.1.27.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Publish Date: 2021-07-27

URL: CVE-2021-32796

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5fg8-2547-mr8q

Release Date: 2021-07-27

Fix Resolution: @xmldom/xmldom - 0.7.0

CVE-2020-8244

Vulnerable Library - bl-3.0.0.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

Library home page: https://registry.npmjs.org/bl/-/bl-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tedious/node_modules/bl/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ❌ bl-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Publish Date: 2020-08-30

URL: CVE-2020-8244

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-pp7h-53gx-mx7r

Release Date: 2020-08-30

Fix Resolution (bl): 3.0.1

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-28155

Vulnerable Library - request-2.88.0.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/adal-node/node_modules/request/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • ❌ request-2.88.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

CVE-2020-28168

Vulnerable Library - axios-0.19.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/axios/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • ❌ axios-0.19.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution (axios): 0.21.1

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-15366

Vulnerable Library - ajv-6.10.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-6.10.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • request-2.88.0.tgz
            • har-validator-5.1.3.tgz
              • ❌ ajv-6.10.2.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-0842

Vulnerable Library - xml2js-0.4.22.tgz

Simple XML to JavaScript object converter.

Library home page: https://registry.npmjs.org/xml2js/-/xml2js-0.4.22.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xml2js/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • ❌ xml2js-0.4.22.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xml2js version 0.4.23 allows an external attacker to edit or add new properties to an object. This is possible because the application does not properly validate incoming JSON keys, thus allowing the proto property to be edited.

Publish Date: 2023-04-05

URL: CVE-2023-0842

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-0842

Release Date: 2023-04-05

Fix Resolution (xml2js): 0.5.0

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-21366

Vulnerable Library - xmldom-0.1.27.tgz

A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).

Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.27.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/xmldom/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • adal-node-0.1.28.tgz
          • ❌ xmldom-0.1.27.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.

Publish Date: 2021-03-12

URL: CVE-2021-21366

CVSS 3 Score Details (4.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-h6q6-9hqw-rwfv

Release Date: 2021-03-12

Fix Resolution (xmldom): 0.5.0

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@azure/ms-rest-js/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • mssql-6.2.3.tgz (Root Library)
    • tedious-6.6.2.tgz
      • ms-rest-nodeauth-2.0.2.tgz
        • ms-rest-js-1.8.13.tgz
          • axios-0.19.0.tgz
            • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (2.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (mssql): 6.3.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

yargs-17.6.2.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - yargs-17.6.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yargs/node_modules/cliui/node_modules/ansi-regex/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (yargs version) Remediation Possible**
CVE-2021-3807 High 7.5 detected in multiple dependencies Transitive 17.7.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-3807

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cliui/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • yargs-17.6.2.tgz (Root Library)
    • cliui-8.0.1.tgz
      • wrap-ansi-7.0.0.tgz
        • string-width-4.1.0.tgz
          • strip-ansi-5.2.0.tgz
            • ❌ ansi-regex-4.1.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yargs/node_modules/cliui/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • yargs-17.6.2.tgz (Root Library)
    • cliui-8.0.1.tgz
      • wrap-ansi-7.0.0.tgz
        • strip-ansi-6.0.0.tgz
          • ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-93q8-gq69-wqmw

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (yargs): 17.7.0

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (yargs): 17.7.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

express-brute-1.0.1.tgz: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - express-brute-1.0.1.tgz

A brute-force protection middleware for express routes that rate limits incoming requests

Library home page: https://registry.npmjs.org/express-brute/-/express-brute-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-brute/package.json

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express-brute version) Remediation Possible**
WS-2019-0056 Critical 9.8 express-brute-1.0.1.tgz Direct express-brute - 0.7.0-beta.0 ✅
CVE-2021-23358 Low 3.3 underscore-1.8.3.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

WS-2019-0056

Vulnerable Library - express-brute-1.0.1.tgz

A brute-force protection middleware for express routes that rate limits incoming requests

Library home page: https://registry.npmjs.org/express-brute/-/express-brute-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-brute/package.json

Dependency Hierarchy:

  • ❌ express-brute-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

All versions of express-brute are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests.

Publish Date: 2019-04-23

URL: WS-2019-0056

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0056

Release Date: 2019-04-23

Fix Resolution: express-brute - 0.7.0-beta.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23358

Vulnerable Library - underscore-1.8.3.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.8.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-brute/node_modules/underscore/package.json

Dependency Hierarchy:

  • express-brute-1.0.1.tgz (Root Library)
    • ❌ underscore-1.8.3.tgz (Vulnerable Library)

Found in HEAD commit: b544ab1bdcd701c07884add83f9af162c4523c4e

Found in base branch: main

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (3.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2

⛑️Automatic Remediation will be attempted for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.