Open mend-bolt-for-github[bot] opened 2 years ago
Easy as cake e-mail sending from your Node.js applications
Library home page: https://registry.npmjs.org/nodemailer/-/nodemailer-4.6.8.tgz
Path to dependency file: /cezerin/package.json
Path to vulnerable library: /node_modules/nodemailer/package.json
Dependency Hierarchy: - :x: **nodemailer-4.6.8.tgz** (Vulnerable Library)
Found in HEAD commit: c7838a0eac341bb8840bc645025fb2f8268cd42c
Found in base branch: master
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Publish Date: 2021-06-29
URL: CVE-2021-23400
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23400
Release Date: 2021-06-29
Fix Resolution: 6.6.1
Step up your Open Source Security Game with Mend here
CVE-2021-23400 - High Severity Vulnerability
Easy as cake e-mail sending from your Node.js applications
Library home page: https://registry.npmjs.org/nodemailer/-/nodemailer-4.6.8.tgz
Path to dependency file: /cezerin/package.json
Path to vulnerable library: /node_modules/nodemailer/package.json
Dependency Hierarchy: - :x: **nodemailer-4.6.8.tgz** (Vulnerable Library)
Found in HEAD commit: c7838a0eac341bb8840bc645025fb2f8268cd42c
Found in base branch: master
The package nodemailer before 6.6.1 are vulnerable to HTTP Header Injection if unsanitized user input that may contain newlines and carriage returns is passed into an address object.
Publish Date: 2021-06-29
URL: CVE-2021-23400
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23400
Release Date: 2021-06-29
Fix Resolution: 6.6.1
Step up your Open Source Security Game with Mend here