Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.
CVE-2020-15095 - Medium Severity Vulnerability
npm-5.1.0.tgz
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-5.1.0.tgz
Dependency Hierarchy: - gitbook-cli-2.3.2.tgz (Root Library) - :x: **npm-5.1.0.tgz** (Vulnerable Library)
npm-2.15.12.tgz
a package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-2.15.12.tgz
Dependency Hierarchy: - gitbook-cli-2.3.2.tgz (Root Library) - npmi-1.0.1.tgz - :x: **npm-2.15.12.tgz** (Vulnerable Library)
Found in HEAD commit: 57add7b0a1f99c21ea28094adb747d0addd0a984
Found in base branch: master
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.
Publish Date: 2020-07-07
URL: CVE-2020-15095
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp
Release Date: 2020-07-07
Fix Resolution: npm - 6.14.6