search

ZSBRybnik / backend

MIT License
2 stars 0 forks source link

better-docs-2.7.2.tgz: 3 vulnerabilities (highest severity is: 9.3) #351

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - better-docs-2.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Found in HEAD commit: d6f11282ee9f4af0baad5df06570b6a9700994af

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (better-docs version) Remediation Possible**
CVE-2023-45133 Critical 9.3 traverse-7.21.3.tgz Transitive 2.7.3 ❌
CVE-2021-21353 Medium 6.8 pug-2.0.4.tgz Transitive N/A* ❌
CVE-2024-6783 Medium 4.8 vue-template-compiler-2.7.14.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133 ### Vulnerable Library - traverse-7.21.3.tgz

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.21.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - better-docs-2.7.2.tgz (Root Library) - react-docgen-5.4.3.tgz - estree-to-babel-3.2.1.tgz - :x: **traverse-7.21.3.tgz** (Vulnerable Library)

Found in HEAD commit: d6f11282ee9f4af0baad5df06570b6a9700994af

Found in base branch: master

### Vulnerability Details

Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

### CVSS 3 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (better-docs): 2.7.3

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-21353 ### Vulnerable Library - pug-2.0.4.tgz

A clean, whitespace-sensitive template language for writing HTML

Library home page: https://registry.npmjs.org/pug/-/pug-2.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - better-docs-2.7.2.tgz (Root Library) - vue-docgen-api-3.26.0.tgz - :x: **pug-2.0.4.tgz** (Vulnerable Library)

Found in HEAD commit: d6f11282ee9f4af0baad5df06570b6a9700994af

Found in base branch: master

### Vulnerability Details

Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the `pretty` option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the `pretty` option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.

Publish Date: 2021-03-03

URL: CVE-2021-21353

### CVSS 3 Score Details (6.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-p493-635q-r6gr

Release Date: 2021-03-03

Fix Resolution: pug -3.0.1, pug-code-gen-2.0.3, pug-code-gen-3.0.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-6783 ### Vulnerable Library - vue-template-compiler-2.7.14.tgz

template compiler for Vue 2.0

Library home page: https://registry.npmjs.org/vue-template-compiler/-/vue-template-compiler-2.7.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /package.json

Dependency Hierarchy: - better-docs-2.7.2.tgz (Root Library) - vue-docgen-api-3.26.0.tgz - :x: **vue-template-compiler-2.7.14.tgz** (Vulnerable Library)

Found in HEAD commit: d6f11282ee9f4af0baad5df06570b6a9700994af

Found in base branch: master

### Vulnerability Details

A vulnerability has been discovered in Vue, that allows an attacker to perform XSS via prototype pollution. The attacker could change the prototype chain of some properties such as `Object.prototype.staticClass` or `Object.prototype.staticStyle` to execute arbitrary JavaScript code.

Publish Date: 2024-07-23

URL: CVE-2024-6783

### CVSS 3 Score Details (4.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
mend-bolt-for-github[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-bolt-for-github[bot] commented 1 year ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.