CVE-2020-28168 (Medium) detected in multiple libraries - fixed

[mend-for-github-com[bot]]

CVE-2020-28168 - Medium Severity Vulnerability

Vulnerable Libraries - axios-0.18.1.tgz, axios-0.19.2.tgz, axios-0.19.0.tgz

axios-0.18.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.18.1.tgz

Path to dependency file: /dashboards/superperf/package.json

Path to vulnerable library: /dashboards/superperf/node_modules/axios/package.json

Dependency Hierarchy: - :x: **axios-0.18.1.tgz** (Vulnerable Library)

axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /performance/AutoPerf/autoPerf_Dashboard/web/package.json

Path to vulnerable library: /performance/AutoPerf/autoPerf_Dashboard/web/node_modules/axios/package.json

Dependency Hierarchy: - pm2-4.4.0.tgz (Root Library) - js-api-0.6.0.tgz - :x: **axios-0.19.2.tgz** (Vulnerable Library)

axios-0.19.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.0.tgz

Path to dependency file: /performance/AutoPerf/autoPerf_Dashboard/gui/package.json

Path to vulnerable library: /performance/AutoPerf/autoPerf_Dashboard/gui/node_modules/axios/package.json

Dependency Hierarchy: - :x: **axios-0.19.0.tgz** (Vulnerable Library)

Found in HEAD commit: 367680d52bae2a20ba5f0475c2c1db26ad062876

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/axios/axios/commit/c7329fefc890050edd51e40e469a154d0117fc55

Release Date: 2020-11-06

Fix Resolution (axios): 0.21.1

Direct dependency fix Resolution (pm2): 4.4.1

---

:rescue_worker_helmet: Automatic Remediation is available for this issue

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[sampadap03]

Fixed by #370

[cortx-admin]

For the convenience of the Seagate development team, this issue has been mirrored in a private Seagate Jira Server: https://jts.seagate.com/browse/CORTX-31725. Note that community members will not be able to access that Jira server but that is not a problem since all activity in that Jira mirror will be copied into this GitHub issue.