search

Tim-Demo / JuiceShop

MIT License
0 stars 0 forks source link

CVE-2022-43441 (High) detected in sqlite3-5.0.2.tgz, node-sqlite3v5.0.2 #170

Open mend-for-github-com[bot] opened 1 year ago

mend-for-github-com[bot] commented 1 year ago

CVE-2022-43441 - High Severity Vulnerability

Vulnerable Libraries - sqlite3-5.0.2.tgz, node-sqlite3v5.0.2

sqlite3-5.0.2.tgz

Asynchronous, non-blocking SQLite3 bindings

Library home page: https://registry.npmjs.org/sqlite3/-/sqlite3-5.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/sqlite3/package.json

Dependency Hierarchy: - :x: **sqlite3-5.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: ba236fd18ec3e6450d68d675bce1609d2e5d3230

Found in base branch: main

Vulnerability Details

A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can lead to arbitrary code execution. An attacker can provide malicious input to trigger this vulnerability.

Publish Date: 2023-03-16

URL: CVE-2022-43441

CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-jqv5-7xpx-qj74

Release Date: 2023-03-16

Fix Resolution: 5.1.5

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.