search

autoai-org / AID

One-Stop System for Machine Learning.
https://aid.autoai.org/
Apache License 2.0
320 stars 33 forks source link

cli-service-4.5.7.tgz: 21 vulnerabilities (highest severity is: 9.8) #1887

Open mend-bolt-for-github[bot] opened 2 years ago

mend-bolt-for-github[bot] commented 2 years ago
Vulnerable Library - cli-service-4.5.7.tgz

Path to dependency file: /components/dashboard/node_modules/@vue/cli-service/package.json

Path to vulnerable library: /components/dashboard/node_modules/highlight.js/package.json

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (cli-service version) Remediation Available
CVE-2022-0691 High 9.8 url-parse-1.4.7.tgz Transitive N/A* ❌
CVE-2022-37601 High 9.8 loader-utils-0.2.17.tgz Transitive N/A* ❌
CVE-2022-37598 High 9.8 uglify-js-3.4.10.tgz Transitive N/A* ❌
WS-2021-0153 High 9.8 ejs-2.7.4.tgz Transitive N/A* ❌
CVE-2022-29078 High 9.8 ejs-2.7.4.tgz Transitive N/A* ❌
CVE-2022-1650 High 9.3 eventsource-1.0.7.tgz Transitive N/A* ❌
CVE-2022-0686 High 9.1 url-parse-1.4.7.tgz Transitive N/A* ❌
CVE-2021-43138 High 7.8 async-2.6.3.tgz Transitive N/A* ❌
CVE-2022-37620 High 7.5 html-minifier-3.5.21.tgz Transitive N/A* ❌
CVE-2021-33502 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-24772 High 7.5 node-forge-0.10.0.tgz Transitive N/A* ❌
CVE-2022-24771 High 7.5 node-forge-0.10.0.tgz Transitive N/A* ❌
WS-2022-0008 Medium 6.6 node-forge-0.10.0.tgz Transitive N/A* ❌
CVE-2022-0122 Medium 6.1 node-forge-0.10.0.tgz Transitive N/A* ❌
CVE-2022-0512 Medium 5.3 url-parse-1.4.7.tgz Transitive N/A* ❌
CVE-2021-3664 Medium 5.3 url-parse-1.4.7.tgz Transitive N/A* ❌
CVE-2022-0639 Medium 5.3 url-parse-1.4.7.tgz Transitive N/A* ❌
CVE-2022-24773 Medium 5.3 node-forge-0.10.0.tgz Transitive N/A* ❌
CVE-2021-23364 Medium 5.3 browserslist-4.14.3.tgz Transitive N/A* ❌
CVE-2021-27515 Medium 5.3 url-parse-1.4.7.tgz Transitive N/A* ❌
WS-2020-0208 Medium 5.3 highlight.js-9.18.3.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-0691 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution: url-parse - 1.5.9

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37601 ### Vulnerable Library - loader-utils-0.2.17.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-0.2.17.tgz

Path to dependency file: /components/dashboard/node_modules/loader-utils/package.json

Path to vulnerable library: /components/dashboard/node_modules/loader-utils/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - html-webpack-plugin-3.2.0.tgz - :x: **loader-utils-0.2.17.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-10-12

Fix Resolution: loader-utils - v2.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37598 ### Vulnerable Library - uglify-js-3.4.10.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-3.4.10.tgz

Path to dependency file: /components/dashboard/node_modules/uglify-js/package.json

Path to vulnerable library: /components/dashboard/node_modules/uglify-js/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - html-webpack-plugin-3.2.0.tgz - html-minifier-3.5.21.tgz - :x: **uglify-js-3.4.10.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

** DISPUTED ** Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Publish Date: 2022-10-20

URL: CVE-2022-37598

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-10-20

Fix Resolution: uglify-js - 3.13.10

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2021-0153 ### Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /components/dashboard/node_modules/ejs/package.json

Path to vulnerable library: /components/dashboard/node_modules/ejs/package.json,/docs/node_modules/ejs/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-bundle-analyzer-3.9.0.tgz - :x: **ejs-2.7.4.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution: ejs - 3.1.6

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-29078 ### Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /components/dashboard/node_modules/ejs/package.json

Path to vulnerable library: /components/dashboard/node_modules/ejs/package.json,/docs/node_modules/ejs/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-bundle-analyzer-3.9.0.tgz - :x: **ejs-2.7.4.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution: ejs - v3.1.7

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-1650 ### Vulnerable Library - eventsource-1.0.7.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/eventsource/package.json,/components/dashboard/node_modules/eventsource/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - :x: **eventsource-1.0.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

### CVSS 3 Score Details (9.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution: eventsource - 1.1.1,2.0.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0686 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution: url-parse - 1.5.8

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-43138 ### Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /components/dashboard/node_modules/async/package.json

Path to vulnerable library: /components/dashboard/node_modules/async/package.json,/docs/node_modules/async/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - portfinder-1.0.28.tgz - :x: **async-2.6.3.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

### CVSS 3 Score Details (7.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution: async - 2.6.4,3.2.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37620 ### Vulnerable Library - html-minifier-3.5.21.tgz

Highly configurable, well-tested, JavaScript-based HTML minifier.

Library home page: https://registry.npmjs.org/html-minifier/-/html-minifier-3.5.21.tgz

Path to dependency file: /components/dashboard/node_modules/html-minifier/package.json

Path to vulnerable library: /components/dashboard/node_modules/html-minifier/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - html-webpack-plugin-3.2.0.tgz - :x: **html-minifier-3.5.21.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.

Publish Date: 2022-10-31

URL: CVE-2022-37620

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-33502 ### Vulnerable Libraries - normalize-url-1.9.1.tgz, normalize-url-3.3.0.tgz

### normalize-url-1.9.1.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-1.9.1.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/normalize-url/package.json,/components/dashboard/node_modules/normalize-url/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - mini-css-extract-plugin-0.9.0.tgz - :x: **normalize-url-1.9.1.tgz** (Vulnerable Library) ### normalize-url-3.3.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-3.3.0.tgz

Path to dependency file: /components/dashboard/node_modules/normalize-url/package.json

Path to vulnerable library: /components/dashboard/node_modules/normalize-url/package.json,/docs/node_modules/postcss-normalize-url/node_modules/normalize-url/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - optimize-cssnano-plugin-1.0.6.tgz - cssnano-preset-default-4.0.7.tgz - postcss-normalize-url-4.0.1.tgz - :x: **normalize-url-3.3.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution: normalize-url - 4.5.1,5.3.1,6.0.1

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-24772 ### Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/node-forge/package.json,/components/dashboard/node_modules/node-forge/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.8.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-24771 ### Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/node-forge/package.json,/components/dashboard/node_modules/node-forge/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.8.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2022-0008 ### Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/node-forge/package.json,/components/dashboard/node_modules/node-forge/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.8.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

### CVSS 3 Score Details (6.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution: node-forge - 1.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0122 ### Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/node-forge/package.json,/components/dashboard/node_modules/node-forge/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.8.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

### CVSS 3 Score Details (6.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution: node-forge - 1.0.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0512 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution: url-parse - 1.5.6

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-3664 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution: url-parse - 1.5.2

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-0639 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution: url-parse - 1.5.7

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-24773 ### Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /docs/package.json

Path to vulnerable library: /docs/node_modules/node-forge/package.json,/components/dashboard/node_modules/node-forge/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - selfsigned-1.10.8.tgz - :x: **node-forge-0.10.0.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24773

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24773

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-23364 ### Vulnerable Library - browserslist-4.14.3.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.14.3.tgz

Path to dependency file: /components/dashboard/node_modules/browserslist/package.json

Path to vulnerable library: /components/dashboard/node_modules/browserslist/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - optimize-cssnano-plugin-1.0.6.tgz - cssnano-preset-default-4.0.7.tgz - postcss-reduce-initial-4.0.3.tgz - caniuse-api-3.0.0.tgz - :x: **browserslist-4.14.3.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-27515 ### Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /components/dashboard/node_modules/url-parse/package.json

Path to vulnerable library: /components/dashboard/node_modules/url-parse/package.json,/docs/node_modules/url-parse/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - webpack-dev-server-3.11.0.tgz - sockjs-client-1.4.0.tgz - eventsource-1.0.7.tgz - original-1.0.2.tgz - :x: **url-parse-1.4.7.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

url-parse before 1.5.0 mishandles certain uses of backslash such as http:\/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27515

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27515

Release Date: 2021-02-22

Fix Resolution: 1.5.0

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0208 ### Vulnerable Library - highlight.js-9.18.3.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-9.18.3.tgz

Path to dependency file: /components/dashboard/node_modules/highlight.js/package.json

Path to vulnerable library: /components/dashboard/node_modules/highlight.js/package.json

Dependency Hierarchy: - cli-service-4.5.7.tgz (Root Library) - cli-highlight-2.1.4.tgz - :x: **highlight.js-9.18.3.tgz** (Vulnerable Library)

Found in base branch: main

### Vulnerability Details

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.

Publish Date: 2020-12-04

URL: WS-2020-0208

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-12-04

Fix Resolution: 10.4.1

Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
stale[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.