search

mindsphere / mindsphere.github.io

Community Documentation
https://developer.siemens.com/industrial-iot-open-source/index.html
MIT License
17 stars 3 forks source link

CVE-2019-10742 (High) detected in axios-0.18.0.tgz #6

Closed mend-bolt-for-github[bot] closed 5 years ago

mend-bolt-for-github[bot] commented 5 years ago

CVE-2019-10742 - High Severity Vulnerability

Vulnerable Library - axios-0.18.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.18.0.tgz

Path to dependency file: /mindsphere.github.io/package.json

Path to vulnerable library: /tmp/git/mindsphere.github.io/node_modules/axios/package.json

Dependency Hierarchy: - eclint-2.8.1.tgz (Root Library) - gulp-reporter-2.10.0.tgz - :x: **axios-0.18.0.tgz** (Vulnerable Library)

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

sn0wcat commented 5 years ago

switch to greenkeeper