Git Product home page Git Product logo

opentok-video-call-center's Introduction

OpenTok Call Center Demo

This demo showcases a simulation of call center where callers queue up to talk to available agents using OpenTok.

Deploy to Heroku

OpenTok features used

These are the OpenTok features used in this demo:

  • Server-side SDK (NodeJS): Used to created dynamic session and token creation per call
  • Publish and subscribe streams: For connecting agent with caller
  • Signaling - To signal for agent join, call hold and call resume.
  • Session monitoring - To keep active caller list updated

Install

Install NodeJS v8.0+

Install dependencies with npm

$ npm install

Get OpenTok API keys and set them as environment variables:

$ export OPENTOK_API_KEY="opentok-api-key-here"
$ export OPENTOK_API_SECRET="opentok-api-secret-here"

Register session monitoring callback in your TokBox account for the path /ot_callback. For example, if this application is hosted at https://example.com, register this URL: https://example.com/ot_callback.

Build assets for the app, run:

$ npm run app-build

Start the server

$ npm start

This will start the application on port 8080. To change port, set the PORT environment variable. For example, to start the application on port 3000, do this:

$ PORT=3000 npm start

To start secure server, set the SECURE environment variable to some value. For example, this will start the application on HTTPS port 3000:

$ SECURE=1 PORT=3000 npm start

Development use

For development use, you can compile assets in development mode and launch server by running:

$ npm run dev

Walkthrough

This application builds a simple queue where callers can wait for agents to talk to them. It uses NodeJS as the backend and VueJS in the frontend.

Note: The server stores all data in-memory for the purpose of this demo. A real-world application should use some database instead.

Application flow

Callers

  • Callers provide their name and reason for call when joining. They can also select whether they want to join as audio-only or using both audio and video.
  • Once callers have joined, they wait in queue till an agent joins that call.
  • Callers remain connected when they have been put on hold or if agent has disconnected.
  • Callers can decide to exit the call at any time.
  • Callers exit if agent triggers call end.

Agents

  • Agents join and wait for callers to be available.
  • Each agent can be assigned multiple callers. Assignment is done using least connections strategy - when a new caller joins, the caller is assigned to the agent with least number of assigned callers.
  • When a caller is assigned to agent, agent's caller list is updated.
  • Agent can join one caller at a time.
  • Agent can put an existing caller on hold to join another caller.
  • Agent can resume a call.
  • Agent can end the call they are connected to. This will make the caller exit as well.
  • Agent can switch between callers that agent has been assigned. If agent switches to another caller, then the current caller is put on hold.

Server

Backend logic for this demo is present in server.js. These are what the server does:

  • Call OpenTok REST API using the OpenTok Node SDK.
  • Create functions to generate OpenTok sessions and tokens.
  • Define Caller constructor used to represent a caller and provide methods to perform actions on each caller.
  • Define Agent constructor used to represent an agent and provide methods to perform actions on each agent.
  • Manage pending callers queue - A list of callers who are yet to be assigned to any agent.
  • Perform assignment of callers to available agents.
  • Send signals through the OpenTok REST API to coordinate interactions between agent and caller.
  • Handle OpenTok session monitoring callbacks for connection created and connection destroyed events. This is used to keep track of when callers are ready to join agents and when they have left.
  • Provides HTTP interfaces for frontend to communicate, with endpoints for agents and callers.

Frontend

The frotend is a simple single-page application (SPA) built on VueJS with vue-router to route between agent and caller screens. It uses UIKit for drawing the UI. The demo intentionally keeps things simple without breaking down code into further components or customizing much of the UI elements.

These are the relevant files:

Agent screen

The agent screen has all the magic in this demo. Here is how agent screen handles callers in the frotnend:

  1. Each caller uses a different OpenTok session.
  2. When agent wants to join a caller, the frontend retrieves a token for the agent for the session of that caller. Then, it connects agent to that session, publishes agent stream and subscribes to existing caller stream.
  3. When agent wants to put a caller on hold, agent unpublishes their stream and disconnects from the session.
  4. When agent wants to resume talking to a caller they have put on hold, step 2 is repeated.

So, the agent keeps on switching between OpenTok sessions - connecting to them and disconnecting as required. This whole process takes a reasonably short time. At each stage, the application sends out signals for each event so that the client UI can adjust accordingly.

Call queue management

A core part of this demo is managing caller queue and assigning callers to agents. All of this happens on the server side in server.js. It uses OpenTok's session monitoring to reliably determine when a caller has connected or disconnected.

Call queue management is composed of six main pieces:

  • callers[]: List of current callers. This is a Map that uses caller ID as key and its corresponding Caller instance as the value.
  • agents[]: List of active agents. This is another Map that uses agent ID as key and its corresponding Agent instance as the value.
  • pendingQueue[]: An array that stores callers (instances of Caller) who are yet to be assigned to any agent.
  • assignCaller(caller): A function that takes a Caller instance as argument and assigns it to an agent. If no agent is connected, this function adds the given caller to pendingQueue[].
  • agent.assignPending(limit = 1): A method on Agent that assigns a number of callers from pendingQueue[] to given agent in FIFO mode - callers who were in the queue earlier are assigned first.
  • removeCaller(callerID): A function that removes a caller from list of active callers and also from pendingQueue[].

Here is a step-by-step description of how the call queue logic is handled:

  1. When a caller connects to the application, the caller screen access the HTTP endpoint at GET /dial.
    • This creates a new instance of the Caller constructor by calling new Caller() based on the caller's supplied details - name, reason and whether the call is audio-only
    • The caller is initial marked as not ready.
    • Then, it tries to assign the caller to an agent by calling assignCaller(caller).
    • Then, it creates a new OpenTok session and token for this caller and sends out a response with the caller status.
  2. The caller screen on the frontend then uses this information to connect to the given OpenTok session and starts publishing the caller's stream.
  3. The server listens to OpenTok session monitoring callbacks in the HTTP endpoint POST /ot_callback.
    • When a caller connects to the session, OpenTok posts data with caller's connection information to this endpoint. The endpoint calls the handleConnectionCreated() handler to match the connection data with the caller ID and marks the caller as ready.
    • Similarly, when a caller disconnects from OpenTok, OpenTok posts the caller's connection information. Then, the endpoint cleans up the caller info by calling removeCaller(callerID).
  4. When an agent joins, the agent interface calls the HTTP endpoint at POST /agent.
    • This creates a new instance of the Agent constructor.
    • Then it attempts to assign first 3 pending callers by calling agent.assignPending(3).
    • Then it returns the agent ID.
  5. The agent screen then keeps on polling the list of callers assigned to the current agent by hitting the HTTP endpoint at /agent/:id/callers.
    • This attempts to assign the first caller in the pendingQueue[] by calling agent.assignPending(1) if the agent has less than 3 callers assigned at that point.
    • Then it returns list of currently assigned callers who are marked as ready (see step 3 above). This ensures that the agent screen only sees list of callers who are currently connected to OpenTok.
  6. When a caller needs to be removed, then frontend calls the HTTP endpoint at GET /call/:id/delete. This calls removeCaller(callerID) internally. The frontend can call this HTTP endpoint when any of these events happen:
    • Caller ends call by clicking "End call" button in the caller's screen
    • Agent ends current call by clicking "End call" button in the agent's screen
    • Caller closes their browser window when call is ongoing
  7. When agent exits, either by closing their browser window or by clicking the "Exit" button, then existing callers assigned to the agent are moved to pendingQueue[]. That way, other agents can pick up those callers.

Development and Contributing

Interested in contributing? We ❤️ pull requests! See the Contribution guidelines.

Getting Help

We love to hear from you so if you have questions, comments or find a bug in the project, let us know! You can either:

Further Reading

opentok-video-call-center's People

Contributors

conshus avatar dependabot[bot] avatar dragonmantank avatar mend-for-github-com[bot] avatar michaeljolley avatar pardel avatar

Stargazers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

Forkers

hlfer rinfimate hkorhola misskhushboo carlosg2 matiaslopezd lemonyellow-labs v-kpheng usama-ejaz-pf dwtcourses davolu abdanbarkaath giuseppemariniello rajeev-india-2020 ahmedjamaaaal pbfigures onlywayisup conshus

opentok-video-call-center's Issues

vue-loader-13.6.1.tgz: 4 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - vue-loader-13.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vue-loader version) Remediation Available
WS-2019-0063 High 8.1 js-yaml-3.10.0.tgz Transitive 13.6.2 ✅
CVE-2021-23382 High 7.5 postcss-6.0.14.tgz Transitive 15.2.5 ✅
CVE-2021-23343 High 7.5 path-parse-1.0.5.tgz Transitive 13.6.2 ✅
WS-2019-0032 High 7.5 js-yaml-3.10.0.tgz Transitive 13.6.2 ✅

Details

WS-2019-0063

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.6.1.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (vue-loader): 13.6.2

⛑️ Automatic Remediation is available for this issue

CVE-2021-23382

Vulnerable Library - postcss-6.0.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss-modules-values/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/icss-utils/node_modules/postcss/package.json

Dependency Hierarchy:

  • vue-loader-13.6.1.tgz (Root Library)
    • ❌ postcss-6.0.14.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (vue-loader): 15.2.5

⛑️ Automatic Remediation is available for this issue

CVE-2021-23343

Vulnerable Library - path-parse-1.0.5.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

  • vue-loader-13.6.1.tgz (Root Library)
    • resolve-1.5.0.tgz
      • ❌ path-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (vue-loader): 13.6.2

⛑️ Automatic Remediation is available for this issue

WS-2019-0032

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.6.1.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (vue-loader): 13.6.2

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-loader-7.1.4.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - babel-loader-7.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 7.1.5 ✅
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 7.1.5 ✅

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.4.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (babel-loader): 7.1.5

⛑️ Automatic Remediation is available for this issue

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.4.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (babel-loader): 7.1.5

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

file-loader-1.1.6.tgz: 1 vulnerabilities (highest severity is: 5.6) - autoclosed

Vulnerable Library - file-loader-1.1.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (file-loader version) Remediation Available
CVE-2020-15366 Medium 5.6 ajv-5.5.2.tgz Transitive 1.1.7 ✅

Details

CVE-2020-15366

Vulnerable Library - ajv-5.5.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Dependency Hierarchy:

  • file-loader-1.1.6.tgz (Root Library)
    • schema-utils-0.3.0.tgz
      • ❌ ajv-5.5.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (file-loader): 1.1.7

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

axios-0.21.4.tgz: 3 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (axios version) Remediation Possible** Reachability
CVE-2024-28849 Medium 6.5 Not Defined 0.0% follow-redirects-1.15.2.tgz Transitive N/A* ❌
CVE-2023-45857 Medium 6.5 Not Defined 0.1% axios-0.21.4.tgz Direct 0.28.0 ✅
CVE-2023-26159 Medium 6.1 Not Defined 0.1% follow-redirects-1.15.2.tgz Transitive 0.22.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-28849

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.21.4.tgz (Root Library)
    • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2023-45857

Vulnerable Library - axios-0.21.4.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.21.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: 0.28.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-26159

Vulnerable Library - follow-redirects-1.15.2.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.21.4.tgz (Root Library)
    • ❌ follow-redirects-1.15.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (axios): 0.22.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

express-4.16.2.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - express-4.16.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (express version) Remediation Available
CVE-2022-24999 High 7.5 qs-6.5.1.tgz Transitive 4.17.0 ✅

Details

CVE-2022-24999

Vulnerable Library - qs-6.5.1.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • express-4.16.2.tgz (Root Library)
    • ❌ qs-6.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (express): 4.17.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

cross-env-5.2.1.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - cross-env-5.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cross-spawn/node_modules/semver/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (cross-env version) Remediation Possible** Reachability
CVE-2022-25883 High 7.5 Not Defined 0.1% semver-5.7.1.tgz Transitive 6.0.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cross-spawn/node_modules/semver/package.json

Dependency Hierarchy:

  • cross-env-5.2.1.tgz (Root Library)
    • cross-spawn-6.0.5.tgz
      • ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 5.7.2

Direct dependency fix Resolution (cross-env): 6.0.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

css-loader-1.0.1.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - css-loader-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (css-loader version) Remediation Available
CVE-2021-23382 High 7.5 postcss-6.0.23.tgz Transitive 2.0.0 ✅

Details

CVE-2021-23382

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss/package.json

Dependency Hierarchy:

  • css-loader-1.0.1.tgz (Root Library)
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (css-loader): 2.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

webpack-5.75.0.tgz: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - webpack-5.75.0.tgz

Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.75.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (webpack version) Remediation Possible** Reachability
CVE-2023-28154 Critical 9.8 Not Defined 0.2% webpack-5.75.0.tgz Direct 5.76.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-28154

Vulnerable Library - webpack-5.75.0.tgz

Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

Library home page: https://registry.npmjs.org/webpack/-/webpack-5.75.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack/package.json

Dependency Hierarchy:

  • ❌ webpack-5.75.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

Publish Date: 2023-03-13

URL: CVE-2023-28154

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-03-13

Fix Resolution: 5.76.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

opentok-2.6.1.tgz: 16 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - opentok-2.6.1.tgz

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (opentok version) Remediation Available
CVE-2022-23540 High 9.8 jsonwebtoken-7.4.3.tgz Transitive N/A* ❌
CVE-2022-23541 High 9.8 jsonwebtoken-7.4.3.tgz Transitive N/A* ❌
CVE-2018-1000620 High 9.8 cryptiles-3.1.2.tgz Transitive 2.6.2 ❌
CVE-2019-10744 High 9.1 lodash-3.10.1.tgz Transitive 2.6.2 ❌
CVE-2022-23539 High 8.1 jsonwebtoken-7.4.3.tgz Transitive N/A* ❌
CVE-2022-31129 High 7.5 moment-2.20.1.tgz Transitive N/A* ❌
CVE-2022-24785 High 7.5 moment-2.20.1.tgz Transitive 2.6.2 ❌
CVE-2018-3737 High 7.5 sshpk-1.13.1.tgz Transitive 2.6.2 ❌
CVE-2022-29167 High 7.5 hawk-6.0.2.tgz Transitive N/A* ❌
CVE-2020-8203 High 7.4 lodash-3.10.1.tgz Transitive 2.6.2 ❌
CVE-2021-23337 High 7.2 lodash-3.10.1.tgz Transitive 2.6.2 ❌
WS-2018-0096 High 7.1 base64url-2.0.0.tgz Transitive 2.6.2 ❌
CVE-2019-1010266 Medium 6.5 lodash-3.10.1.tgz Transitive 2.6.2 ❌
CVE-2018-3721 Medium 6.5 lodash-3.10.1.tgz Transitive 2.6.2 ❌
CVE-2018-16487 Medium 5.6 lodash-3.10.1.tgz Transitive 2.6.2 ❌
CVE-2020-28500 Medium 5.3 lodash-3.10.1.tgz Transitive 2.6.2 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-23540

Vulnerable Library - jsonwebtoken-7.4.3.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • ❌ jsonwebtoken-7.4.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition in the jwt.verify() function can lead to signature validation bypass due to defaulting to the none algorithm for signature verification. Users are affected if you do not specify algorithms in the jwt.verify() function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the jwt.verify() method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the none algorithm. If you need 'none' algorithm, you have to explicitly specify that in jwt.verify() options.

Publish Date: 2022-12-22

URL: CVE-2022-23540

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-23540

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-23541

Vulnerable Library - jsonwebtoken-7.4.3.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • ❌ jsonwebtoken-7.4.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

jsonwebtoken is an implementation of JSON Web Tokens. Versions <= 8.5.1 of jsonwebtoken library can be misconfigured so that passing a poorly implemented key retrieval function referring to the secretOrPublicKey argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

Publish Date: 2022-12-22

URL: CVE-2022-23541

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjrf-2m68-5959

Release Date: 2022-12-22

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2018-1000620

Vulnerable Library - cryptiles-3.1.2.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-3.1.2.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • request-2.83.0.tgz
      • hawk-6.0.2.tgz
        • ❌ cryptiles-3.1.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution (cryptiles): 4.1.2

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2019-10744

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2022-23539

Vulnerable Library - jsonwebtoken-7.4.3.tgz

JSON Web Token implementation (symmetric and asymmetric)

Library home page: https://registry.npmjs.org/jsonwebtoken/-/jsonwebtoken-7.4.3.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • ❌ jsonwebtoken-7.4.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions <=8.5.1 of jsonwebtoken library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the allowInvalidAsymmetricKeyTypes option to true in the sign() and/or verify() functions.

Publish Date: 2022-12-23

URL: CVE-2022-23539

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cf7-32gw-wr33

Release Date: 2022-12-23

Fix Resolution: jsonwebtoken - 9.0.0

CVE-2022-31129

Vulnerable Library - moment-2.20.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.20.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • jsonwebtoken-7.4.3.tgz
      • joi-6.10.1.tgz
        • ❌ moment-2.20.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: moment - 2.29.4

CVE-2022-24785

Vulnerable Library - moment-2.20.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.20.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • jsonwebtoken-7.4.3.tgz
      • joi-6.10.1.tgz
        • ❌ moment-2.20.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution (moment): 2.29.2

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2018-3737

Vulnerable Library - sshpk-1.13.1.tgz

A library for finding and using SSH public keys

Library home page: https://registry.npmjs.org/sshpk/-/sshpk-1.13.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • request-2.83.0.tgz
      • http-signature-1.2.0.tgz
        • ❌ sshpk-1.13.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

Publish Date: 2018-06-07

URL: CVE-2018-3737

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/319593

Release Date: 2018-06-07

Fix Resolution (sshpk): 1.13.2

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2022-29167

Vulnerable Library - hawk-6.0.2.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-6.0.2.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • request-2.83.0.tgz
      • ❌ hawk-6.0.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP header (Hawk.utils.parseHost()), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. parseHost() was patched in 9.0.1 to use built-in URL class to parse hostname instead. Hawk.authenticate() accepts options argument. If that contains host and port, those would be used instead of a call to utils.parseHost().

Publish Date: 2022-05-05

URL: CVE-2022-29167

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-44pw-h2cw-w3vq

Release Date: 2022-05-05

Fix Resolution: hawk - 9.0.1

CVE-2020-8203

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2021-23337

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.6.2

WS-2018-0096

Vulnerable Library - base64url-2.0.0.tgz

For encoding to/from base64urls

Library home page: https://registry.npmjs.org/base64url/-/base64url-2.0.0.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • jsonwebtoken-7.4.3.tgz
      • jws-3.1.4.tgz
        • ❌ base64url-2.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of base64url before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.

Publish Date: 2018-05-16

URL: WS-2018-0096

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/321687

Release Date: 2018-01-27

Fix Resolution (base64url): 3.0.0

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2019-1010266

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2018-3721

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2018-16487

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (opentok): 2.6.2

CVE-2020-28500

Vulnerable Library - lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Dependency Hierarchy:

  • opentok-2.6.1.tgz (Root Library)
    • opentok-token-1.1.0.tgz
      • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (opentok): 2.6.2

webpack-4.46.0.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - webpack-4.46.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (webpack version) Remediation Available
CVE-2020-28469 High 7.5 glob-parent-3.1.0.tgz Transitive 5.0.0 ✅

Details

CVE-2020-28469

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json

Dependency Hierarchy:

  • webpack-4.46.0.tgz (Root Library)
    • watchpack-1.7.5.tgz
      • watchpack-chokidar2-2.0.1.tgz
        • chokidar-2.1.8.tgz
          • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (webpack): 5.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

vue-loader-13.6.2.tgz: 4 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - vue-loader-13.6.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vue-loader version) Remediation Available
WS-2019-0063 High 8.1 js-yaml-3.10.0.tgz Transitive 13.7.0 ✅
CVE-2021-23382 High 7.5 postcss-6.0.23.tgz Transitive 15.2.5 ✅
CVE-2021-23343 High 7.5 path-parse-1.0.5.tgz Transitive 13.7.0 ✅
WS-2019-0032 High 7.5 js-yaml-3.10.0.tgz Transitive 13.7.0 ✅

Details

WS-2019-0063

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.6.2.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (vue-loader): 13.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23382

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json

Dependency Hierarchy:

  • vue-loader-13.6.2.tgz (Root Library)
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (vue-loader): 15.2.5

⛑️ Automatic Remediation is available for this issue

CVE-2021-23343

Vulnerable Library - path-parse-1.0.5.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

  • vue-loader-13.6.2.tgz (Root Library)
    • resolve-1.5.0.tgz
      • ❌ path-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (vue-loader): 13.7.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0032

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.6.2.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (vue-loader): 13.7.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-core-6.26.0.tgz: 8 vulnerabilities (highest severity is: 9.1) - autoclosed

Vulnerable Library - babel-core-6.26.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-core version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2020-8203 High 7.4 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2021-23337 High 7.2 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2022-46175 High 7.1 json5-0.5.1.tgz Transitive N/A* ❌
CVE-2019-1010266 Medium 6.5 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2018-3721 Medium 6.5 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2018-16487 Medium 5.6 lodash-4.17.4.tgz Transitive 6.26.2 ✅
CVE-2020-28500 Medium 5.3 lodash-4.17.4.tgz Transitive 6.26.2 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2019-10744

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2022-46175

Vulnerable Library - json5-0.5.1.tgz

JSON for the ES5 era.

Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ json5-0.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including version 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution: json5 - 2.2.2

CVE-2019-1010266

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.0.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 6.26.2

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

vue-2.5.14.tgz: 1 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - vue-2.5.14.tgz

Reactive, component-oriented view layer for modern web interfaces.

Library home page: https://registry.npmjs.org/vue/-/vue-2.5.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue/package.json

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vue version) Remediation Available
WS-2018-0162 Medium 6.1 vue-2.5.14.tgz Direct 2.5.17 ✅

Details

WS-2018-0162

Vulnerable Library - vue-2.5.14.tgz

Reactive, component-oriented view layer for modern web interfaces.

Library home page: https://registry.npmjs.org/vue/-/vue-2.5.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue/package.json

Dependency Hierarchy:

  • ❌ vue-2.5.14.tgz (Vulnerable Library)

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Found in base branch: main

Vulnerability Details

Vue.js before 2.5.17 vesion in vue poject have potential xss in ssr when using v-bind.

Publish Date: 2018-08-01

URL: WS-2018-0162

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-08-01

Fix Resolution: 2.5.17

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

core-7.20.12.tgz: 2 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - core-7.20.12.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/traverse/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (core version) Remediation Possible** Reachability
CVE-2023-45133 High 8.8 Not Defined 0.1% traverse-7.20.13.tgz Transitive 7.21.0 ✅
CVE-2022-25883 High 7.5 Not Defined 0.1% semver-6.3.0.tgz Transitive 7.22.6 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133

Vulnerable Library - traverse-7.20.13.tgz

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.20.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/@babel/traverse/package.json

Dependency Hierarchy:

  • core-7.20.12.tgz (Root Library)
    • ❌ traverse-7.20.13.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (@babel/core): 7.21.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Dependency Hierarchy:

  • core-7.20.12.tgz (Root Library)
    • ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (@babel/core): 7.22.6

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

axios-0.21.1.tgz: 3 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - axios-0.21.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (axios version) Remediation Available
CVE-2021-3749 High 7.5 axios-0.21.1.tgz Direct 0.21.2 ✅
CVE-2022-0155 Medium 6.5 follow-redirects-1.13.3.tgz Transitive 0.21.2 ✅
CVE-2022-0536 Medium 5.9 follow-redirects-1.13.3.tgz Transitive 0.21.2 ✅

Details

CVE-2021-3749

Vulnerable Library - axios-0.21.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.21.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: 0.21.2

⛑️ Automatic Remediation is available for this issue

CVE-2022-0155

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.21.1.tgz (Root Library)
    • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (axios): 0.21.2

⛑️ Automatic Remediation is available for this issue

CVE-2022-0536

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.21.1.tgz (Root Library)
    • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (axios): 0.21.2

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-loader-7.1.2.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - babel-loader-7.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 7.1.3 ✅
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 7.1.3 ✅

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.2.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (babel-loader): 7.1.3

⛑️ Automatic Remediation is available for this issue

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.2.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (babel-loader): 7.1.3

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

webpack-dev-server-2.9.7.tgz: 52 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - webpack-dev-server-2.9.7.tgz

Serves a webpack app. Updates the browser on changes.

Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-2.9.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-server/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (webpack-dev-server version) Remediation Available
CVE-2018-3774 High 9.8 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-7774 High 9.8 y18n-3.2.1.tgz Transitive 2.10.0 ✅
CVE-2018-1000620 High 9.8 cryptiles-2.0.5.tgz Transitive 2.10.0 ❌
CVE-2021-44906 High 9.8 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-7788 High 9.8 ini-1.3.4.tgz Transitive 2.10.0 ❌
CVE-2021-3918 High 9.8 json-schema-0.2.3.tgz Transitive 2.10.0 ❌
CVE-2018-3750 High 9.8 deep-extend-0.4.2.tgz Transitive 2.10.0 ❌
CVE-2022-0691 High 9.8 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2018-16492 High 9.8 extend-3.0.1.tgz Transitive 2.10.0 ❌
CVE-2022-1650 High 9.3 eventsource-0.1.6.tgz Transitive 3.1.10 ✅
CVE-2022-0686 High 9.1 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2018-3728 High 8.8 hoek-2.16.3.tgz Transitive 2.10.0 ❌
CVE-2021-37701 High 8.6 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2021-37712 High 8.6 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2021-37713 High 8.6 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2021-32804 High 8.1 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2021-32803 High 8.1 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2017-15010 High 7.5 tough-cookie-2.3.2.tgz Transitive 2.10.0 ❌
CVE-2018-3737 High 7.5 sshpk-1.13.0.tgz Transitive 2.10.0 ❌
CVE-2022-29167 High 7.5 hawk-3.1.3.tgz Transitive N/A* ❌
CVE-2018-14732 High 7.5 webpack-dev-server-2.9.7.tgz Direct 3.1.6 ✅
CVE-2020-7662 High 7.5 websocket-extensions-0.1.3.tgz Transitive 2.10.0 ✅
CVE-2021-23424 High 7.5 ansi-html-0.0.7.tgz Transitive 3.11.3 ✅
CVE-2018-20834 High 7.5 tar-2.2.1.tgz Transitive 2.10.0 ❌
CVE-2020-28469 High 7.5 glob-parent-2.0.0.tgz Transitive 4.0.0 ✅
CVE-2021-33623 High 7.5 trim-newlines-1.0.0.tgz Transitive 3.1.7 ✅
CVE-2022-24772 High 7.5 node-forge-0.6.33.tgz Transitive 4.7.1 ✅
CVE-2022-24771 High 7.5 node-forge-0.6.33.tgz Transitive 4.7.1 ✅
CVE-2022-24999 High 7.5 qs-6.4.0.tgz Transitive 2.10.0 ❌
CVE-2022-3517 High 7.5 minimatch-3.0.4.tgz Transitive N/A* ❌
WS-2020-0091 High 7.5 http-proxy-1.16.2.tgz Transitive 2.10.0 ✅
CVE-2019-13173 High 7.5 fstream-1.0.11.tgz Transitive 2.10.0 ❌
WS-2018-0588 High 7.4 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-7720 High 7.3 node-forge-0.6.33.tgz Transitive 2.10.0 ✅
WS-2022-0008 Medium 6.6 node-forge-0.6.33.tgz Transitive 4.7.1 ✅
CVE-2018-21270 Medium 6.5 stringstream-0.0.5.tgz Transitive 2.10.0 ❌
CVE-2021-23386 Medium 6.5 dns-packet-1.2.2.tgz Transitive 2.10.0 ✅
CVE-2022-0122 Medium 6.1 node-forge-0.6.33.tgz Transitive 4.7.1 ✅
CVE-2020-7598 Medium 5.6 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-15366 Medium 5.6 ajv-4.11.8.tgz Transitive 2.10.0 ❌
CVE-2020-7693 Medium 5.3 sockjs-0.3.18.tgz Transitive 3.11.0 ✅
CVE-2022-0512 Medium 5.3 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2021-3664 Medium 5.3 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2017-16137 Medium 5.3 debug-2.6.8.tgz Transitive 2.10.0 ❌
CVE-2022-24773 Medium 5.3 node-forge-0.6.33.tgz Transitive 4.7.1 ✅
CVE-2021-27515 Medium 5.3 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-8124 Medium 5.3 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2020-7608 Medium 5.3 yargs-parser-4.2.1.tgz Transitive 2.10.0 ✅
CVE-2022-0639 Medium 5.3 detected in multiple dependencies Transitive 2.10.0 ✅
CVE-2021-23362 Medium 5.3 hosted-git-info-2.5.0.tgz Transitive 2.10.0 ✅
CVE-2017-16028 Medium 5.3 randomatic-1.1.7.tgz Transitive 2.10.0 ✅
WS-2018-0103 Medium 4.8 stringstream-0.0.5.tgz Transitive 2.10.0 ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (20 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2018-3774

Vulnerable Libraries - url-parse-1.2.0.tgz, url-parse-1.0.5.tgz

url-parse-1.2.0.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.2.0.tgz (Vulnerable Library)

url-parse-1.0.5.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/original/node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • eventsource-0.1.6.tgz
        • original-1.0.0.tgz
          • ❌ url-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Publish Date: 2018-08-12

URL: CVE-2018-3774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3774

Release Date: 2018-08-12

Fix Resolution (url-parse): 1.4.3

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

Fix Resolution (url-parse): 1.4.3

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • yargs-6.6.0.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 3.2.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-1000620

Vulnerable Library - cryptiles-2.0.5.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • hawk-3.1.3.tgz
            • ❌ cryptiles-2.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution (cryptiles): 4.1.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-44906

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • mkdirp-0.5.1.tgz
            • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • internal-ip-1.2.0.tgz
      • meow-3.7.0.tgz
        • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution (minimist): 0.2.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (webpack-dev-server): 3.1.7

⛑️ Automatic Remediation is available for this issue

CVE-2020-7788

Vulnerable Library - ini-1.3.4.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.4.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • rc-1.2.1.tgz
            • ❌ ini-1.3.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • request-2.81.0.tgz
            • http-signature-1.1.1.tgz
              • jsprim-1.4.0.tgz
                • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2018-3750

Vulnerable Library - deep-extend-0.4.2.tgz

Recursive object extending

Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.2.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • rc-1.2.1.tgz
            • ❌ deep-extend-0.4.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Publish Date: 2018-07-03

URL: CVE-2018-3750

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750

Release Date: 2018-07-03

Fix Resolution (deep-extend): 0.5.1

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2022-0691

Vulnerable Libraries - url-parse-1.2.0.tgz, url-parse-1.0.5.tgz

url-parse-1.2.0.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.2.0.tgz (Vulnerable Library)

url-parse-1.0.5.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/original/node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • eventsource-0.1.6.tgz
        • original-1.0.0.tgz
          • ❌ url-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-16492

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • request-2.81.0.tgz
            • ❌ extend-3.0.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution (extend): 3.0.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2022-1650

Vulnerable Library - eventsource-0.1.6.tgz

W3C compliant EventSource client for Node.js

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-0.1.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • ❌ eventsource-0.1.6.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution (eventsource): 1.1.1

Direct dependency fix Resolution (webpack-dev-server): 3.1.10

⛑️ Automatic Remediation is available for this issue

CVE-2022-0686

Vulnerable Libraries - url-parse-1.0.5.tgz, url-parse-1.2.0.tgz

url-parse-1.0.5.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/original/node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • eventsource-0.1.6.tgz
        • original-1.0.0.tgz
          • ❌ url-parse-1.0.5.tgz (Vulnerable Library)

url-parse-1.2.0.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-3728

Vulnerable Library - hoek-2.16.3.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • hawk-3.1.3.tgz
            • ❌ hoek-2.16.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082

Release Date: 2018-03-30

Fix Resolution (hoek): 4.2.0

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-37701

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-37712

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-37713

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-32804

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2021-32803

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.3

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2017-15010

Vulnerable Library - tough-cookie-2.3.2.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.3.2.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • request-2.81.0.tgz
            • ❌ tough-cookie-2.3.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Publish Date: 2017-10-04

URL: CVE-2017-15010

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15010

Release Date: 2017-10-04

Fix Resolution (tough-cookie): 2.3.3

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2018-3737

Vulnerable Library - sshpk-1.13.0.tgz

A library for finding and using SSH public keys

Library home page: https://registry.npmjs.org/sshpk/-/sshpk-1.13.0.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • request-2.81.0.tgz
            • http-signature-1.1.1.tgz
              • ❌ sshpk-1.13.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

Publish Date: 2018-06-07

URL: CVE-2018-3737

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/319593

Release Date: 2018-06-07

Fix Resolution (sshpk): 1.13.2

Direct dependency fix Resolution (webpack-dev-server): 2.10.0

CVE-2022-29167

Vulnerable Library - hawk-3.1.3.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz

Dependency Hierarchy:

  • webpack-dev-server-2.9.7.tgz (Root Library)
    • chokidar-1.7.0.tgz
      • fsevents-1.1.3.tgz
        • node-pre-gyp-0.6.39.tgz
          • ❌ hawk-3.1.3.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP header (Hawk.utils.parseHost()), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. parseHost() was patched in 9.0.1 to use built-in URL class to parse hostname instead. Hawk.authenticate() accepts options argument. If that contains host and port, those would be used instead of a call to utils.parseHost().

Publish Date: 2022-05-05

URL: CVE-2022-29167

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-44pw-h2cw-w3vq

Release Date: 2022-05-05

Fix Resolution: hawk - 9.0.1

⛑️ Automatic Remediation is available for this issue.

No callers connected

Hola he terminado de hacer deploy en heroku y he creado varios clientes, pero en la sección de agentes no me en lista ninguno. También no he podido localizar la sección donde se da de alta a un agente.

webpack-3.10.0.tgz: 10 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - webpack-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (webpack version) Remediation Available
CVE-2020-7774 High 9.8 y18n-3.2.1.tgz Transitive 3.11.0 ✅
CVE-2021-43138 High 7.8 async-2.6.0.tgz Transitive 4.0.0 ✅
CVE-2020-13822 High 7.7 elliptic-6.4.0.tgz Transitive 3.11.0 ✅
CVE-2021-3807 High 7.5 ansi-regex-3.0.0.tgz Transitive 3.11.0 ✅
CVE-2020-28498 Medium 6.8 elliptic-6.4.0.tgz Transitive 3.11.0 ✅
WS-2019-0427 Medium 5.9 elliptic-6.4.0.tgz Transitive 3.11.0 ✅
WS-2019-0424 Medium 5.9 elliptic-6.4.0.tgz Transitive 3.11.0 ✅
CVE-2020-15366 Medium 5.6 ajv-5.5.2.tgz Transitive 3.11.0 ✅
CVE-2020-7608 Medium 5.3 yargs-parser-7.0.0.tgz Transitive 4.0.0 ✅
WS-2019-0307 Medium 5.1 mem-1.1.0.tgz Transitive 4.0.0 ✅

Details

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • yargs-8.0.2.tgz
      • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 3.2.2

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-43138

Vulnerable Library - async-2.6.0.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • ❌ async-2.6.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (webpack): 4.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-13822

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • create-ecdh-4.0.0.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution (elliptic): 6.5.3

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/strip-ansi/node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • yargs-8.0.2.tgz
      • string-width-2.1.1.tgz
        • strip-ansi-4.0.0.tgz
          • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28498

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • create-ecdh-4.0.0.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

Publish Date: 2021-02-02

URL: CVE-2020-28498

CVSS 3 Score Details (6.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498

Release Date: 2021-02-02

Fix Resolution (elliptic): 6.5.4

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0427

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • create-ecdh-4.0.0.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The function getNAF() in elliptic library has information leakage. This issue is mitigated in version 6.5.2

Publish Date: 2019-11-22

URL: WS-2019-0427

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-11-22

Fix Resolution (elliptic): 6.5.2

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0424

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • create-ecdh-4.0.0.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

all versions of elliptic are vulnerable to Timing Attack through side-channels.

Publish Date: 2019-11-13

URL: WS-2019-0424

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2019-0424

Release Date: 2019-11-13

Fix Resolution (elliptic): 6.5.3

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-15366

Vulnerable Library - ajv-5.5.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • ❌ ajv-5.5.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (webpack): 3.11.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-7608

Vulnerable Library - yargs-parser-7.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • yargs-8.0.2.tgz
      • ❌ yargs-parser-7.0.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 13.1.2

Direct dependency fix Resolution (webpack): 4.0.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0307

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mem/package.json

Dependency Hierarchy:

  • webpack-3.10.0.tgz (Root Library)
    • yargs-8.0.2.tgz
      • os-locale-2.1.0.tgz
        • ❌ mem-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

In 'mem' before v4.0.0 there is a Denial of Service (DoS) vulnerability as a result of a failure in removal old values from the cache.

Publish Date: 2018-08-27

URL: WS-2019-0307

CVSS 3 Score Details (5.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2018-08-27

Fix Resolution (mem): 4.0.0

Direct dependency fix Resolution (webpack): 4.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

express-4.18.2.tgz: 1 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - express-4.18.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (express version) Remediation Possible** Reachability
CVE-2024-29041 Medium 6.1 Not Defined 0.0% express-4.18.2.tgz Direct 4.19.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-29041

Vulnerable Library - express-4.18.2.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express/package.json

Dependency Hierarchy:

  • ❌ express-4.18.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: 4.19.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

babel-loader-7.1.3.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - babel-loader-7.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 7.1.4 ✅
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 7.1.4 ✅

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.3.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (babel-loader): 7.1.4

⛑️ Automatic Remediation is available for this issue

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.3.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (babel-loader): 7.1.4

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

css-loader-5.2.7.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - css-loader-5.2.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (css-loader version) Remediation Possible** Reachability
CVE-2023-44270 Medium 5.3 Not Defined 0.1% postcss-8.4.21.tgz Transitive 6.9.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-44270

Vulnerable Library - postcss-8.4.21.tgz

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.21.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

  • css-loader-5.2.7.tgz (Root Library)
    • ❌ postcss-8.4.21.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution (postcss): 8.4.31

Direct dependency fix Resolution (css-loader): 6.9.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

vue-2.5.13.tgz: 2 vulnerabilities (highest severity is: 6.1) - autoclosed

Vulnerable Library - vue-2.5.13.tgz

Reactive, component-oriented view layer for modern web interfaces.

Library home page: https://registry.npmjs.org/vue/-/vue-2.5.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vue version) Remediation Available
WS-2018-0162 Medium 6.1 vue-2.5.13.tgz Direct 2.5.17 ✅
WS-2018-0596 Low 3.7 vue-2.5.13.tgz Direct 2.5.14 ✅

Details

WS-2018-0162

Vulnerable Library - vue-2.5.13.tgz

Reactive, component-oriented view layer for modern web interfaces.

Library home page: https://registry.npmjs.org/vue/-/vue-2.5.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue/package.json

Dependency Hierarchy:

  • ❌ vue-2.5.13.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Vue.js before 2.5.17 vesion in vue poject have potential xss in ssr when using v-bind.

Publish Date: 2018-08-01

URL: WS-2018-0162

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-08-01

Fix Resolution: 2.5.17

⛑️ Automatic Remediation is available for this issue

WS-2018-0596

Vulnerable Library - vue-2.5.13.tgz

Reactive, component-oriented view layer for modern web interfaces.

Library home page: https://registry.npmjs.org/vue/-/vue-2.5.13.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue/package.json

Dependency Hierarchy:

  • ❌ vue-2.5.13.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Vue-Project before version 2.5.14 has a potential regex backtrack vulnerability.

Publish Date: 2018-02-21

URL: WS-2018-0596

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-02-21

Fix Resolution: 2.5.14

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

vue-loader-13.7.0.tgz: 4 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - vue-loader-13.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vue-loader version) Remediation Available
WS-2019-0063 High 8.1 js-yaml-3.10.0.tgz Transitive 13.7.1 ✅
CVE-2021-23382 High 7.5 postcss-6.0.23.tgz Transitive 15.2.5 ✅
CVE-2021-23343 High 7.5 path-parse-1.0.5.tgz Transitive 13.7.1 ✅
WS-2019-0032 High 7.5 js-yaml-3.10.0.tgz Transitive 13.7.1 ✅

Details

WS-2019-0063

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.7.0.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (vue-loader): 13.7.1

⛑️ Automatic Remediation is available for this issue

CVE-2021-23382

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json

Dependency Hierarchy:

  • vue-loader-13.7.0.tgz (Root Library)
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (vue-loader): 15.2.5

⛑️ Automatic Remediation is available for this issue

CVE-2021-23343

Vulnerable Library - path-parse-1.0.5.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/path-parse/package.json

Dependency Hierarchy:

  • vue-loader-13.7.0.tgz (Root Library)
    • resolve-1.5.0.tgz
      • ❌ path-parse-1.0.5.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-05-04

Fix Resolution (path-parse): 1.0.7

Direct dependency fix Resolution (vue-loader): 13.7.1

⛑️ Automatic Remediation is available for this issue

WS-2019-0032

Vulnerable Library - js-yaml-3.10.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

  • vue-loader-13.7.0.tgz (Root Library)
    • postcss-load-config-1.2.0.tgz
      • cosmiconfig-2.2.2.tgz
        • ❌ js-yaml-3.10.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (vue-loader): 13.7.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

file-loader-1.1.7.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - file-loader-1.1.7.tgz

Path to dependency file: /package.json

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (file-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 1.1.8 ❌
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 1.1.8 ❌

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Dependency Hierarchy:

  • file-loader-1.1.7.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (file-loader): 1.1.8

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Dependency Hierarchy:

  • file-loader-1.1.7.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (file-loader): 1.1.8

body-parser-1.18.2.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - body-parser-1.18.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (body-parser version) Remediation Available
CVE-2022-24999 High 7.5 qs-6.5.1.tgz Transitive 1.19.0 ✅

Details

CVE-2022-24999

Vulnerable Library - qs-6.5.1.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • body-parser-1.18.2.tgz (Root Library)
    • ❌ qs-6.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.5.3

Direct dependency fix Resolution (body-parser): 1.19.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

css-loader-1.0.1.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - css-loader-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (css-loader version) Remediation Available
CVE-2021-23382 High 7.5 postcss-6.0.23.tgz Transitive 2.0.0 ✅

Details

CVE-2021-23382

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/vue-loader/node_modules/postcss/package.json,/node_modules/postcss/package.json

Dependency Hierarchy:

  • css-loader-1.0.1.tgz (Root Library)
    • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (css-loader): 2.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

opentok-2.15.2.tgz: 3 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - opentok-2.15.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (opentok version) Remediation Possible** Reachability
CVE-2023-26136 Critical 9.8 Not Defined 0.1% tough-cookie-2.5.0.tgz Transitive 2.17.0 ✅
CVE-2022-25883 High 7.5 Not Defined 0.1% semver-7.3.8.tgz Transitive 2.17.0 ✅
CVE-2023-28155 Medium 6.1 Not Defined 0.1% request-2.88.2.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • opentok-2.15.2.tgz (Root Library)
    • request-2.88.2.tgz
      • ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (opentok): 2.17.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Library - semver-7.3.8.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-7.3.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jsonwebtoken/node_modules/semver/package.json,/node_modules/css-loader/node_modules/semver/package.json

Dependency Hierarchy:

  • opentok-2.15.2.tgz (Root Library)
    • jsonwebtoken-9.0.0.tgz
      • ❌ semver-7.3.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 7.5.2

Direct dependency fix Resolution (opentok): 2.17.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-28155

Vulnerable Library - request-2.88.2.tgz

Simplified HTTP request client.

Library home page: https://registry.npmjs.org/request/-/request-2.88.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/request/package.json

Dependency Hierarchy:

  • opentok-2.15.2.tgz (Root Library)
    • ❌ request-2.88.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The request package through 2.88.2 for Node.js and the @cypress/request package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).NOTE: The request package is no longer supported by the maintainer.

Publish Date: 2023-03-16

URL: CVE-2023-28155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-p8p7-x288-28g6

Release Date: 2023-03-16

Fix Resolution: @cypress/request - 3.0.0

⛑️Automatic Remediation will be attempted for this issue.

axios-0.17.1.tgz: 5 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - axios-0.17.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (axios version) Remediation Available
CVE-2019-10742 High 7.5 axios-0.17.1.tgz Direct 0.18.1 ✅
CVE-2021-3749 High 7.5 axios-0.17.1.tgz Direct 0.18.1 ✅
CVE-2022-0155 Medium 6.5 follow-redirects-1.2.6.tgz Transitive 0.18.0 ✅
CVE-2022-0536 Medium 5.9 follow-redirects-1.2.6.tgz Transitive 0.18.0 ✅
CVE-2020-28168 Medium 5.9 axios-0.17.1.tgz Direct 0.21.1 ✅

Details

CVE-2019-10742

Vulnerable Library - axios-0.17.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.17.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-05-07

Fix Resolution: 0.18.1

⛑️ Automatic Remediation is available for this issue

CVE-2021-3749

Vulnerable Library - axios-0.17.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.17.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: 0.18.1

⛑️ Automatic Remediation is available for this issue

CVE-2022-0155

Vulnerable Library - follow-redirects-1.2.6.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.2.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.17.1.tgz (Root Library)
    • ❌ follow-redirects-1.2.6.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (axios): 0.18.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-0536

Vulnerable Library - follow-redirects-1.2.6.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.2.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.17.1.tgz (Root Library)
    • ❌ follow-redirects-1.2.6.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (axios): 0.18.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28168

Vulnerable Library - axios-0.17.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.17.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.17.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: 0.21.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-loader-7.1.5.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - babel-loader-7.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 8.0.0 ✅
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 8.0.0 ✅

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.5.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (babel-loader): 8.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • babel-loader-7.1.5.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (babel-loader): 8.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-preset-env-1.6.1.tgz: 7 vulnerabilities (highest severity is: 9.1) - autoclosed

Vulnerable Library - babel-preset-env-1.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-preset-env version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2020-8203 High 7.4 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2021-23337 High 7.2 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2019-1010266 Medium 6.5 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2018-3721 Medium 6.5 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2018-16487 Medium 5.6 lodash-4.17.4.tgz Transitive 1.7.0 ✅
CVE-2020-28500 Medium 5.3 lodash-4.17.4.tgz Transitive 1.7.0 ✅

Details

CVE-2019-10744

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-helper-regex/node_modules/lodash/package.json,/node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-plugin-transform-es2015-block-scoping/node_modules/lodash/package.json,/node_modules/babel-helper-define-map/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-preset-env-1.6.1.tgz (Root Library)
    • babel-plugin-transform-es2015-classes-6.24.1.tgz
      • babel-helper-define-map-6.26.0.tgz
        • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-preset-env): 1.7.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

css-loader-0.28.7.tgz: 9 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - css-loader-0.28.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/svgo/node_modules/js-yaml/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (css-loader version) Remediation Available
CVE-2018-13797 High 9.8 macaddress-0.2.8.tgz Transitive 0.28.8 ✅
WS-2019-0063 High 8.1 js-yaml-3.7.0.tgz Transitive 1.0.0 ✅
WS-2019-0541 High 7.5 macaddress-0.2.8.tgz Transitive 0.28.8 ✅
WS-2021-0152 High 7.5 color-string-0.3.0.tgz Transitive 1.0.0 ✅
CVE-2021-23382 High 7.5 detected in multiple dependencies Transitive 2.0.0 ✅
CVE-2021-29059 High 7.5 is-svg-2.1.0.tgz Transitive 1.0.0 ✅
CVE-2021-28092 High 7.5 is-svg-2.1.0.tgz Transitive 1.0.0 ✅
WS-2019-0032 High 7.5 js-yaml-3.7.0.tgz Transitive 1.0.0 ✅
CVE-2021-29060 Medium 5.3 color-string-0.3.0.tgz Transitive 1.0.0 ✅

Details

CVE-2018-13797

Vulnerable Library - macaddress-0.2.8.tgz

Get the MAC addresses (hardware addresses) of the hosts network interfaces.

Library home page: https://registry.npmjs.org/macaddress/-/macaddress-0.2.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/macaddress/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-filter-plugins-2.0.2.tgz
        • uniqid-4.1.1.tgz
          • ❌ macaddress-0.2.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.

Publish Date: 2018-07-10

URL: CVE-2018-13797

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-13797

Release Date: 2018-07-10

Fix Resolution (macaddress): 0.2.9

Direct dependency fix Resolution (css-loader): 0.28.8

⛑️ Automatic Remediation is available for this issue

WS-2019-0063

Vulnerable Library - js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/svgo/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-svgo-2.1.6.tgz
        • svgo-0.7.2.tgz
          • ❌ js-yaml-3.7.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0541

Vulnerable Library - macaddress-0.2.8.tgz

Get the MAC addresses (hardware addresses) of the hosts network interfaces.

Library home page: https://registry.npmjs.org/macaddress/-/macaddress-0.2.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/macaddress/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-filter-plugins-2.0.2.tgz
        • uniqid-4.1.1.tgz
          • ❌ macaddress-0.2.8.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Arbitrary File Read vulnerability was found in macaddress before 0.4.3.

Publish Date: 2019-08-20

URL: WS-2019-0541

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-20

Fix Resolution (macaddress): 0.4.3

Direct dependency fix Resolution (css-loader): 0.28.8

⛑️ Automatic Remediation is available for this issue

WS-2021-0152

Vulnerable Library - color-string-0.3.0.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-colormin-2.2.2.tgz
        • colormin-1.1.2.tgz
          • color-0.11.4.tgz
            • ❌ color-string-0.3.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-12

Fix Resolution (color-string): 1.5.5

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23382

Vulnerable Libraries - postcss-5.2.18.tgz, postcss-6.0.14.tgz

postcss-5.2.18.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-5.2.18.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • ❌ postcss-5.2.18.tgz (Vulnerable Library)

postcss-6.0.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/icss-utils/node_modules/postcss/package.json,/node_modules/postcss-modules-local-by-default/node_modules/postcss/package.json,/node_modules/postcss-modules-scope/node_modules/postcss/package.json,/node_modules/postcss-modules-extract-imports/node_modules/postcss/package.json,/node_modules/postcss-modules-values/node_modules/postcss/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • icss-utils-2.1.0.tgz
      • ❌ postcss-6.0.14.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (css-loader): 2.0.0

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (css-loader): 2.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-29059

Vulnerable Library - is-svg-2.1.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-2.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/is-svg/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-svgo-2.1.6.tgz
        • ❌ is-svg-2.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A vulnerability was discovered in IS-SVG version 2.1.0 to 4.2.2 and below where a Regular Expression Denial of Service (ReDOS) occurs if the application is provided and checks a crafted invalid SVG string.

Publish Date: 2021-06-21

URL: CVE-2021-29059

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-21

Fix Resolution (is-svg): 4.3.0

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-28092

Vulnerable Library - is-svg-2.1.0.tgz

Check if a string or buffer is SVG

Library home page: https://registry.npmjs.org/is-svg/-/is-svg-2.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/is-svg/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-svgo-2.1.6.tgz
        • ❌ is-svg-2.1.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

The is-svg package 2.1.0 through 4.2.1 for Node.js uses a regular expression that is vulnerable to Regular Expression Denial of Service (ReDoS). If an attacker provides a malicious string, is-svg will get stuck processing the input for a very long time.

Publish Date: 2021-03-12

URL: CVE-2021-28092

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28092

Release Date: 2021-03-12

Fix Resolution (is-svg): 4.2.2

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

WS-2019-0032

Vulnerable Library - js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/svgo/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-svgo-2.1.6.tgz
        • svgo-0.7.2.tgz
          • ❌ js-yaml-3.7.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-29060

Vulnerable Library - color-string-0.3.0.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • css-loader-0.28.7.tgz (Root Library)
    • cssnano-3.10.0.tgz
      • postcss-colormin-2.2.2.tgz
        • colormin-1.1.2.tgz
          • color-0.11.4.tgz
            • ❌ color-string-0.3.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Color-String version 1.5.5 and below which occurs when the application is provided and checks a crafted invalid HWB string.

Publish Date: 2021-06-21

URL: CVE-2021-29060

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-257v-vj4p-3w2h

Release Date: 2021-06-21

Fix Resolution (color-string): 1.5.5

Direct dependency fix Resolution (css-loader): 1.0.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

body-parser-1.19.0.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - body-parser-1.19.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/body-parser/node_modules/qs/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (body-parser version) Remediation Available
CVE-2022-24999 High 7.5 qs-6.7.0.tgz Transitive 1.19.1 ✅

Details

CVE-2022-24999

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/body-parser/node_modules/qs/package.json

Dependency Hierarchy:

  • body-parser-1.19.0.tgz (Root Library)
    • ❌ qs-6.7.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (body-parser): 1.19.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

Issue with join as a agent

I cannot connect with the agent no matter what. I am able to bring up the caller screen with "Waiting for agent to join…" only after that nothing happens. In the agent screen i am receiving "No callers connected" always. Please kindly help me out.

file-loader-1.1.8.tgz: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - file-loader-1.1.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (file-loader version) Remediation Available
CVE-2022-37601 High 9.8 loader-utils-1.1.0.tgz Transitive 1.1.9 ✅
CVE-2022-37603 High 7.5 loader-utils-1.1.0.tgz Transitive 1.1.9 ✅

Details

CVE-2022-37601

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • file-loader-1.1.8.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (file-loader): 1.1.9

⛑️ Automatic Remediation is available for this issue

CVE-2022-37603

Vulnerable Library - loader-utils-1.1.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • file-loader-1.1.8.tgz (Root Library)
    • ❌ loader-utils-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 2.0.4

Direct dependency fix Resolution (file-loader): 1.1.9

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

babel-core-6.26.3.tgz: 8 vulnerabilities (highest severity is: 9.1) - autoclosed

Vulnerable Library - babel-core-6.26.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-core version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2022-46175 High 8.8 json5-0.5.1.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2020-8203 High 7.4 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2021-23337 High 7.2 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2019-1010266 Medium 6.5 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2018-3721 Medium 6.5 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2018-16487 Medium 5.6 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2020-28500 Medium 5.3 lodash-4.17.4.tgz Transitive 7.0.0-bridge.0 ✅

Details

CVE-2019-10744

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-46175

Vulnerable Library - json5-0.5.1.tgz

JSON for the ES5 era.

Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • ❌ json5-0.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-traverse/node_modules/lodash/package.json,/node_modules/babel-template/node_modules/lodash/package.json,/node_modules/babel-types/node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.3.tgz (Root Library)
    • babel-template-6.26.0.tgz
      • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in HEAD commit: 8653cc64d8fa59a7d177d4d0e4390301bf147c77

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

webpack-dev-server-4.11.1.tgz: 3 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - webpack-dev-server-4.11.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (webpack-dev-server version) Remediation Possible** Reachability
CVE-2024-4068 High 7.5 Not Defined 0.0% braces-3.0.2.tgz Transitive N/A* ❌
CVE-2024-29180 High 7.4 Not Defined 0.0% webpack-dev-middleware-5.3.3.tgz Transitive 4.12.0 ✅
CVE-2024-4067 Medium 5.3 Not Defined 0.0% micromatch-4.0.5.tgz Transitive 4.12.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-4068

Vulnerable Library - braces-3.0.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.

Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/braces/package.json

Dependency Hierarchy:

  • webpack-dev-server-4.11.1.tgz (Root Library)
    • chokidar-3.5.3.tgz
      • ❌ braces-3.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Found in base branch: main

Vulnerability Details

The NPM package braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In lib/parse.js, if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4068

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution: braces - 3.0.3

CVE-2024-29180

Vulnerable Library - webpack-dev-middleware-5.3.3.tgz

A development middleware for webpack

Library home page: https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-5.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-middleware/package.json

Dependency Hierarchy:

  • webpack-dev-server-4.11.1.tgz (Root Library)
    • ❌ webpack-dev-middleware-5.3.3.tgz (Vulnerable Library)

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Found in base branch: main

Vulnerability Details

Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory memfs filesystem. If writeToDisk configuration option is set to true, the physical filesystem is used. The getFilenameFromUrl method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the unsecaped path suffix is appended to the outputPath. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use %2e and %2f sequences to perform path traversal attack.

Developers using webpack-dev-server or webpack-dev-middleware are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or 0.0.0.0), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.

Publish Date: 2024-03-21

URL: CVE-2024-29180

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wr3j-pwj9-hqq6

Release Date: 2024-03-21

Fix Resolution (webpack-dev-middleware): 5.3.4

Direct dependency fix Resolution (webpack-dev-server): 4.12.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-4067

Vulnerable Library - micromatch-4.0.5.tgz

Glob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.

Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/micromatch/package.json

Dependency Hierarchy:

  • webpack-dev-server-4.11.1.tgz (Root Library)
    • http-proxy-middleware-2.0.6.tgz
      • ❌ micromatch-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 9d14ef85d82f18894d0385d9571d929161a86cf2

Found in base branch: main

Vulnerability Details

The NPM package micromatch is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in micromatch.braces() in index.js because the pattern .* will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.

Publish Date: 2024-05-14

URL: CVE-2024-4067

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2024-05-14

Fix Resolution (micromatch): 4.0.6

Direct dependency fix Resolution (webpack-dev-server): 4.12.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

babel-core-6.26.2.tgz: 8 vulnerabilities (highest severity is: 9.1) - autoclosed

Vulnerable Library - babel-core-6.26.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (babel-core version) Remediation Available
CVE-2019-10744 High 9.1 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2022-46175 High 8.8 json5-0.5.1.tgz Transitive 7.0.0-bridge.0 ✅
CVE-2020-8203 High 7.4 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2021-23337 High 7.2 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2019-1010266 Medium 6.5 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2018-3721 Medium 6.5 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2018-16487 Medium 5.6 lodash-4.17.4.tgz Transitive 6.26.3 ✅
CVE-2020-28500 Medium 5.3 lodash-4.17.4.tgz Transitive 6.26.3 ✅

Details

CVE-2019-10744

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash): 4.17.12

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2022-46175

Vulnerable Library - json5-0.5.1.tgz

JSON for the ES5 era.

Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ json5-0.5.1.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (babel-core): 7.0.0-bridge.0

⛑️ Automatic Remediation is available for this issue

CVE-2020-8203

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.9

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2021-23337

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution (lodash): 4.17.5

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2018-16487

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution (lodash): 4.17.11

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

CVE-2020-28500

Vulnerable Library - lodash-4.17.4.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • babel-core-6.26.2.tgz (Root Library)
    • ❌ lodash-4.17.4.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (babel-core): 6.26.3

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.