Open mend-bolt-for-github[bot] opened 3 years ago
:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.
CVE-2021-38384 - Critical Severity Vulnerability
Vulnerable Libraries - serverless-offline-5.12.1.tgz, serverless-offline-6.8.0.tgz, serverless-offline-3.31.0.tgz, serverless-offline-3.20.1.tgz, serverless-offline-6.9.0.tgz, serverless-offline-6.5.0.tgz, serverless-offline-3.33.0.tgz, serverless-offline-4.10.6.tgz, serverless-offline-3.25.4.tgz, serverless-offline-7.0.0.tgz
serverless-offline-5.12.1.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-5.12.1.tgz
Path to dependency file: /aws-node-puppeteer/package.json
Path to vulnerable library: /aws-node-puppeteer/node_modules/serverless-offline/package.json,/aws-node-rest-api-typescript/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-5.12.1.tgz** (Vulnerable Library)
serverless-offline-6.8.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-6.8.0.tgz
Path to dependency file: /azure-node-typescript-servicebus-trigger-endpoint/package.json
Path to vulnerable library: /azure-node-typescript-servicebus-trigger-endpoint/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-6.8.0.tgz** (Vulnerable Library)
serverless-offline-3.31.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-3.31.0.tgz
Path to dependency file: /aws-node-github-check/package.json
Path to vulnerable library: /aws-node-github-check/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-3.31.0.tgz** (Vulnerable Library)
serverless-offline-3.20.1.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-3.20.1.tgz
Path to dependency file: /aws-node-signed-uploads/package.json
Path to vulnerable library: /aws-node-signed-uploads/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-3.20.1.tgz** (Vulnerable Library)
serverless-offline-6.9.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-6.9.0.tgz
Path to dependency file: /aws-node-http-api-dynamodb-local/package.json
Path to vulnerable library: /aws-node-http-api-dynamodb-local/node_modules/serverless-offline/package.json,/aws-node-http-api-typescript/node_modules/serverless-offline/package.json,/aws-node-rest-api-typescript-simple/node_modules/serverless-offline/package.json,/aws-node-rest-api-with-dynamodb-and-offline/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-6.9.0.tgz** (Vulnerable Library)
serverless-offline-6.5.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-6.5.0.tgz
Path to dependency file: /aws-node-typescript-apollo-lambda/package.json
Path to vulnerable library: /aws-node-typescript-apollo-lambda/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-6.5.0.tgz** (Vulnerable Library)
serverless-offline-3.33.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-3.33.0.tgz
Path to dependency file: /aws-python-auth0-custom-authorizers-api/package.json
Path to vulnerable library: /aws-python-auth0-custom-authorizers-api/node_modules/serverless-offline/package.json,/aws-node-auth0-custom-authorizers-api/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-3.33.0.tgz** (Vulnerable Library)
serverless-offline-4.10.6.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-4.10.6.tgz
Path to dependency file: /aws-node-dynamic-image-resizer/package.json
Path to vulnerable library: /aws-node-dynamic-image-resizer/node_modules/serverless-offline/package.json,/aws-node-vue-nuxt-ssr/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-4.10.6.tgz** (Vulnerable Library)
serverless-offline-3.25.4.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-3.25.4.tgz
Path to dependency file: /aws-node-oauth-dropbox-api/package.json
Path to vulnerable library: /aws-node-oauth-dropbox-api/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-3.25.4.tgz** (Vulnerable Library)
serverless-offline-7.0.0.tgz
Emulate AWS λ and API Gateway locally when developing your Serverless project
Library home page: https://registry.npmjs.org/serverless-offline/-/serverless-offline-7.0.0.tgz
Path to dependency file: /aws-node-typescript-nest/package.json
Path to vulnerable library: /aws-node-typescript-nest/node_modules/serverless-offline/package.json
Dependency Hierarchy: - :x: **serverless-offline-7.0.0.tgz** (Vulnerable Library)
Found in HEAD commit: dcbe4aefe4b3685f4b15493a01db0f19b118a0c4
Found in base branch: master
Vulnerability Details
Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implement incorrect access control, because the actual behavior within the Amazon AWS environment is a 200 HTTP status code (i.e., possibly greater than expected permissions).
Publish Date: 2021-08-10
URL: CVE-2021-38384
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-38384
Release Date: 2021-08-10
Fix Resolution: 8.1.0
Step up your Open Source Security Game with Mend here