8.1

CVE-2019-16776

Unauthorized File Access in npm CLI before before version 6.13.3

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Npmjs ≫ Npm Version < 6.13.3
Opensuse ≫ Leap Version 15.1
Oracle ≫ Graalvm Version 19.3.0.2 SwEdition enterprise
Fedoraproject ≫ Fedora Version 31
Redhat ≫ Enterprise Linux Version 8.0
Redhat ≫ Enterprise Linux Eus Version 8.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.41% 0.876
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
NIST 5.5 8 4.9
AV:N/AC:L/Au:S/C:P/I:P/A:N
security-advisories@github.com 7.7 1.3 5.8
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

https://www.oracle.com/security-alerts/cpujan2020.html
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
Third Party Advisory
Mailing List
https://access.redhat.com/errata/RHEA-2020:0330
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0573
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0579
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0597
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0602
Third Party Advisory
https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
Third Party Advisory
https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46
Third Party Advisory