search

kimxogus / react-native-version-check

A version checker for react-native applications
MIT License
722 stars 179 forks source link

CVE-2019-5413 (High) detected in morgan-1.6.1.tgz #78

Closed mend-bolt-for-github[bot] closed 5 years ago

mend-bolt-for-github[bot] commented 5 years ago

CVE-2019-5413 - High Severity Vulnerability

Vulnerable Library - morgan-1.6.1.tgz

HTTP request logger middleware for node.js

Library home page: https://registry.npmjs.org/morgan/-/morgan-1.6.1.tgz

Path to dependency file: /react-native-version-check/packages/react-native-version-check-expo/package.json

Path to vulnerable library: /tmp/git/react-native-version-check/packages/react-native-version-check-expo/node_modules/morgan/package.json,/tmp/git/react-native-version-check/packages/react-native-version-check-expo/node_modules/morgan/package.json

Dependency Hierarchy: - react-native-0.48.4.tgz (Root Library) - connect-2.30.2.tgz - :x: **morgan-1.6.1.tgz** (Vulnerable Library)

Found in HEAD commit: d52a5161ca4eeb5387c6b83aba1683450896bcd8

Vulnerability Details

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Publish Date: 2019-03-21

URL: CVE-2019-5413

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390881

Release Date: 2019-03-21

Fix Resolution: 1.9.1

Step up your Open Source Security Game with WhiteSource here