search

UrielProd / ecommerce-store

0 stars 0 forks source link

react-scripts-3.4.1.tgz: 56 vulnerabilities (highest severity is: 9.8) - autoclosed #8

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - react-scripts-3.4.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/loader-utils/package.json

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (react-scripts version) Fix PR available
CVE-2020-15256 High 9.8 object-path-0.11.4.tgz Transitive 3.4.4 ✅
CVE-2020-7788 High 9.8 ini-1.3.5.tgz Transitive 3.4.4 ✅
CVE-2021-3757 High 9.8 immer-1.10.0.tgz Transitive N/A* ❌
CVE-2022-0691 High 9.8 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2022-37601 High 9.8 detected in multiple dependencies Transitive N/A* ❌
CVE-2021-23436 High 9.8 immer-1.10.0.tgz Transitive N/A* ❌
CVE-2021-26707 High 9.8 merge-deep-3.0.2.tgz Transitive 3.4.4 ✅
CVE-2021-23440 High 9.8 set-value-2.0.1.tgz Transitive N/A* ❌
CVE-2021-42740 High 9.8 shell-quote-1.7.2.tgz Transitive N/A* ❌
CVE-2022-1650 High 9.3 eventsource-1.0.7.tgz Transitive 3.4.4 ✅
CVE-2022-0686 High 9.1 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2022-46175 High 8.8 detected in multiple dependencies Transitive 3.4.4 ✅
CVE-2021-23434 High 8.6 object-path-0.11.4.tgz Transitive 3.4.4 ✅
CVE-2020-7660 High 8.1 serialize-javascript-2.1.2.tgz Transitive 3.4.4 ✅
CVE-2021-43138 High 7.8 async-2.6.3.tgz Transitive 3.4.4 ✅
CVE-2020-13822 High 7.7 elliptic-6.5.2.tgz Transitive 3.4.4 ✅
CVE-2021-27290 High 7.5 detected in multiple dependencies Transitive 3.4.4 ✅
CVE-2021-23382 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-37603 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2021-23343 High 7.5 path-parse-1.0.6.tgz Transitive 3.4.4 ✅
CVE-2021-23424 High 7.5 ansi-html-0.0.7.tgz Transitive N/A* ❌
CVE-2022-25858 High 7.5 terser-4.7.0.tgz Transitive 3.4.4 ✅
CVE-2020-28469 High 7.5 detected in multiple dependencies Transitive N/A* ❌
WS-2021-0152 High 7.5 color-string-1.5.3.tgz Transitive 3.4.4 ✅
CVE-2021-29059 High 7.5 is-svg-3.0.0.tgz Transitive 3.4.4 ✅
CVE-2022-24772 High 7.5 node-forge-0.9.0.tgz Transitive N/A* ❌
CVE-2022-24771 High 7.5 node-forge-0.9.0.tgz Transitive N/A* ❌
CVE-2021-3805 High 7.5 object-path-0.11.4.tgz Transitive 3.4.4 ✅
CVE-2021-3803 High 7.5 nth-check-1.0.2.tgz Transitive N/A* ❌
CVE-2021-3807 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-24999 High 7.5 qs-6.7.0.tgz Transitive N/A* ❌
CVE-2020-28477 High 7.5 immer-1.10.0.tgz Transitive N/A* ❌
CVE-2021-28092 High 7.5 is-svg-3.0.0.tgz Transitive 3.4.4 ✅
CVE-2021-3777 High 7.5 tmpl-1.0.4.tgz Transitive 3.4.4 ✅
CVE-2020-7720 High 7.3 node-forge-0.9.0.tgz Transitive 3.4.4 ✅
CVE-2020-28498 Medium 6.8 elliptic-6.5.2.tgz Transitive 3.4.4 ✅
WS-2022-0008 Medium 6.6 node-forge-0.9.0.tgz Transitive N/A* ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.11.0.tgz Transitive 3.4.4 ✅
CVE-2021-23386 Medium 6.5 dns-packet-1.3.1.tgz Transitive 3.4.4 ✅
CVE-2022-0122 Medium 6.1 node-forge-0.9.0.tgz Transitive N/A* ❌
CVE-2022-0536 Medium 5.9 follow-redirects-1.11.0.tgz Transitive 3.4.4 ✅
WS-2019-0424 Medium 5.9 elliptic-6.5.2.tgz Transitive 3.4.4 ✅
CVE-2020-7789 Medium 5.6 node-notifier-5.4.3.tgz Transitive 3.4.4 ✅
CVE-2021-24033 Medium 5.6 react-dev-utils-10.2.1.tgz Transitive N/A* ❌
CVE-2020-15366 Medium 5.6 ajv-6.12.2.tgz Transitive 3.4.4 ✅
CVE-2020-7693 Medium 5.3 sockjs-0.3.19.tgz Transitive 3.4.4 ✅
CVE-2022-0512 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2021-32640 Medium 5.3 detected in multiple dependencies Transitive 3.4.4 ✅
CVE-2021-3664 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2022-24773 Medium 5.3 node-forge-0.9.0.tgz Transitive N/A* ❌
CVE-2021-27515 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2021-29060 Medium 5.3 color-string-1.5.3.tgz Transitive 3.4.4 ✅
CVE-2020-7608 Medium 5.3 yargs-parser-11.1.1.tgz Transitive 3.4.4 ✅
CVE-2022-0639 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.4.4 ✅
CVE-2021-23364 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2021-23368 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (19 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2020-15256 ### Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/object-path/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - adjust-sourcemap-loader-2.0.0.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

A prototype pollution vulnerability has been found in `object-path` <= 0.11.4 affecting the `set()` method. The vulnerability is limited to the `includeInheritedProps` mode (if version >= 0.11.0 is used), which has to be explicitly enabled by creating a new instance of `object-path` and setting the option `includeInheritedProps: true`, or by using the default `withInheritedProps` instance. The default operating mode is not affected by the vulnerability if version >= 0.11.0 is used. Any usage of `set()` in versions < 0.11.0 is vulnerable. The issue is fixed in object-path version 0.11.5 As a workaround, don't use the `includeInheritedProps: true` options or the `withInheritedProps` instance if using a version >= 0.11.0.

Publish Date: 2020-10-19

URL: CVE-2020-15256

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/mariocasciaro/object-path/security/advisories/GHSA-cwx2-736x-mf6w

Release Date: 2020-10-19

Fix Resolution (object-path): 0.11.5

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-7788 ### Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/ini/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - global-modules-2.0.0.tgz - global-prefix-3.0.0.tgz - :x: **ini-1.3.5.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): v1.3.6

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-3757 ### Vulnerable Library - immer-1.10.0.tgz

Create your next immutable state by mutating the current one

Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/immer/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-09-02

URL: CVE-2021-3757

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/

Release Date: 2021-09-02

Fix Resolution: immer - 9.0.6

CVE-2022-0691 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/url-parse/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): url-parse - 1.5.9

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-37601 ### Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

### loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library) ### loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution: loader-utils - v2.0.0

CVE-2021-23436 ### Vulnerable Library - immer-1.10.0.tgz

Create your next immutable state by mutating the current one

Library home page: https://registry.npmjs.org/immer/-/immer-1.10.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/immer/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **immer-1.10.0.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "__proto__" || p === "constructor") in applyPatches_ returns false if p is ['__proto__'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

Publish Date: 2021-09-01

URL: CVE-2021-23436

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436

Release Date: 2021-09-01

Fix Resolution: immer - 9.0.6

CVE-2021-26707 ### Vulnerable Library - merge-deep-3.0.2.tgz

Recursively merge values in a javascript object.

Library home page: https://registry.npmjs.org/merge-deep/-/merge-deep-3.0.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/merge-deep/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - plugin-svgo-4.3.1.tgz - :x: **merge-deep-3.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.

Publish Date: 2021-06-02

URL: CVE-2021-26707

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1922259

Release Date: 2021-06-02

Fix Resolution (merge-deep): 3.0.3

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23440 ### Vulnerable Library - set-value-2.0.1.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/set-value/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - micromatch-3.1.10.tgz - snapdragon-0.8.2.tgz - base-0.11.2.tgz - cache-base-1.0.1.tgz - :x: **set-value-2.0.1.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

This affects the package set-value before <2.0.1, >=3.0.0 <4.0.1. A type confusion vulnerability can lead to a bypass of CVE-2019-10747 when the user-provided keys used in the path parameter are arrays. Mend Note: After conducting further research, Mend has determined that all versions of set-value up to version 4.0.0 are vulnerable to CVE-2021-23440.

Publish Date: 2021-09-12

URL: CVE-2021-23440

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-09-12

Fix Resolution: set-value - 4.0.1

CVE-2021-42740 ### Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/shell-quote/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **shell-quote-1.7.2.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution: shell-quote - 1.7.3

CVE-2022-1650 ### Vulnerable Library - eventsource-1.0.7.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/eventsource/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **eventsource-1.0.7.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

### CVSS 3 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution (eventsource): eventsource - 1.1.1,2.0.2

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-0686 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/url-parse/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - sockjs-client-1.4.0.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): url-parse - 1.5.8

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2022-46175 ### Vulnerable Libraries - json5-2.1.3.tgz, json5-1.0.1.tgz

### json5-2.1.3.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.1.3.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/json5/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - core-7.9.0.tgz - :x: **json5-2.1.3.tgz** (Vulnerable Library) ### json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/json5/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/json5/package.json,/frontend/node_modules/react-dev-utils/node_modules/json5/package.json,/frontend/node_modules/loader-utils/node_modules/json5/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - loader-utils-1.4.0.tgz - :x: **json5-1.0.1.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): json5 - 2.2.2

Direct dependency fix Resolution (react-scripts): 3.4.4

Fix Resolution (json5): json5 - 2.2.2

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23434 ### Vulnerable Library - object-path-0.11.4.tgz

Access deep object properties using a path

Library home page: https://registry.npmjs.org/object-path/-/object-path-0.11.4.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/object-path/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - adjust-sourcemap-loader-2.0.0.tgz - :x: **object-path-0.11.4.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

This affects the package object-path before 0.11.6. A type confusion vulnerability can lead to a bypass of CVE-2020-15256 when the path components used in the path parameter are arrays. In particular, the condition currentPath === '__proto__' returns false if currentPath is ['__proto__']. This is because the === operator returns always false when the type of the operands is different.

Publish Date: 2021-08-27

URL: CVE-2021-23434

### CVSS 3 Score Details (8.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23434

Release Date: 2021-08-27

Fix Resolution (object-path): object-path - 0.11.6

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-7660 ### Vulnerable Library - serialize-javascript-2.1.2.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/serialize-javascript/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - terser-webpack-plugin-2.3.5.tgz - :x: **serialize-javascript-2.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: 2020-06-01

URL: CVE-2020-7660

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660

Release Date: 2020-06-08

Fix Resolution (serialize-javascript): serialize-javascript - 3.1.0

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-43138 ### Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/async/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - portfinder-1.0.26.tgz - :x: **async-2.6.3.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

### CVSS 3 Score Details (7.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): async - 2.6.4,3.2.2

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2020-13822 ### Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/elliptic/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - node-libs-browser-2.2.1.tgz - crypto-browserify-3.12.0.tgz - browserify-sign-4.2.0.tgz - :x: **elliptic-6.5.2.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

### CVSS 3 Score Details (7.7)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution (elliptic): v6.5.3

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-27290 ### Vulnerable Libraries - ssri-7.1.0.tgz, ssri-6.0.1.tgz

### ssri-7.1.0.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-7.1.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/ssri/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - terser-webpack-plugin-2.3.5.tgz - cacache-13.0.1.tgz - :x: **ssri-7.1.0.tgz** (Vulnerable Library) ### ssri-6.0.1.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-6.0.1.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/webpack/node_modules/ssri/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.42.0.tgz - terser-webpack-plugin-1.4.4.tgz - cacache-12.0.4.tgz - :x: **ssri-6.0.1.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Publish Date: 2021-03-12

URL: CVE-2021-27290

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-vx3p-948g-6vhq

Release Date: 2021-03-12

Fix Resolution (ssri): ssri - 6.0.2,7.1.1,8.0.1

Direct dependency fix Resolution (react-scripts): 3.4.4

Fix Resolution (ssri): ssri - 6.0.2,7.1.1,8.0.1

Direct dependency fix Resolution (react-scripts): 3.4.4

:rescue_worker_helmet: Automatic Remediation is available for this issue
CVE-2021-23382 ### Vulnerable Libraries - postcss-7.0.21.tgz, postcss-7.0.32.tgz

### postcss-7.0.21.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.21.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/postcss/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **postcss-7.0.21.tgz** (Vulnerable Library) ### postcss-7.0.32.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.32.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/postcss/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - css-loader-3.4.2.tgz - :x: **postcss-7.0.32.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern \/\*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

CVE-2022-37603 ### Vulnerable Libraries - loader-utils-1.2.3.tgz, loader-utils-1.4.0.tgz

### loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/frontend/node_modules/react-dev-utils/node_modules/loader-utils/package.json,/frontend/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - resolve-url-loader-3.1.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library) ### loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /frontend/package.json

Path to vulnerable library: /frontend/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-4.3.3.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: 56a9616db4d4f9f39d7bb9da3ce6483d5b572a6b

Found in base branch: main

### Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution: loader-utils - 1.4.2,2.0.4,3.2.1

:rescue_worker_helmet: Automatic Remediation is available for this issue.

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.