Open mend-bolt-for-github[bot] opened 2 years ago
General purpose node utilities
Library home page: https://registry.npmjs.org/@hapi/hoek/-/hoek-8.2.4.tgz
Path to dependency file: /wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /wp-content/themes/twentytwenty/node_modules/@hapi/hoek/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-puppeteer-4.3.0.tgz - jest-environment-puppeteer-4.3.0.tgz - jest-dev-server-4.3.0.tgz - wait-on-3.3.0.tgz - joi-15.1.1.tgz - :x: **hoek-8.2.4.tgz** (Vulnerable Library)
Found in HEAD commit: 6464f631e15c1e1c888b6d505d934cf06ab4d0a2
Found in base branch: master
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Publish Date: 2022-09-23
URL: CVE-2020-36604
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Release Date: 2022-09-23
Fix Resolution (@hapi/hoek): 8.5.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend here
CVE-2020-36604 - High Severity Vulnerability
General purpose node utilities
Library home page: https://registry.npmjs.org/@hapi/hoek/-/hoek-8.2.4.tgz
Path to dependency file: /wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /wp-content/themes/twentytwenty/node_modules/@hapi/hoek/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-puppeteer-4.3.0.tgz - jest-environment-puppeteer-4.3.0.tgz - jest-dev-server-4.3.0.tgz - wait-on-3.3.0.tgz - joi-15.1.1.tgz - :x: **hoek-8.2.4.tgz** (Vulnerable Library)
Found in HEAD commit: 6464f631e15c1e1c888b6d505d934cf06ab4d0a2
Found in base branch: master
hoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Publish Date: 2022-09-23
URL: CVE-2020-36604
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2022-09-23
Fix Resolution (@hapi/hoek): 8.5.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend here