WS-2019-0163 (Medium) detected in bower-1.8.0.tgz

[mend-for-github-com[bot]]

WS-2019-0163 - Medium Severity Vulnerability

Vulnerable Library - bower-1.8.0.tgz

The browser package manager

Library home page: https://registry.npmjs.org/bower/-/bower-1.8.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/bower/package.json

Dependency Hierarchy: - :x: **bower-1.8.0.tgz** (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

bower before 1.8.8 has an n arbitrary file write vulnerability. caused by Symlink Arbitrary File Overwrite

Publish Date: 2019-01-23

URL: WS-2019-0163

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/776

Release Date: 2019-07-15

Fix Resolution: 1.8.8

---

• [ ] Check this box to open an automated fix PR

[MartinaGold]

The vulnerability was fixed in this PR https://github.com/loggly/loggly-jslogger/pull/80/files