search

opentok / insights-dashboard-sample

Sample React app utilizing the OpenTok Insights GraphQL API
https://tokbox.com/developer/guides/insights/
Other
6 stars 14 forks source link

react-scripts-4.0.3.tgz: 73 vulnerabilities (highest severity is: 9.8) reachable #56

Open mend-for-github-com[bot] opened 2 years ago

mend-for-github-com[bot] commented 2 years ago
Vulnerable Library - react-scripts-4.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (react-scripts version) Remediation Possible** Reachability
CVE-2023-26159 High 7.3 Proof of concept 0.1% follow-redirects-1.13.3.tgz Transitive 5.0.0 ✅

Reachable
CVE-2024-28849 Medium 6.5 Not Defined 0.0% follow-redirects-1.13.3.tgz Transitive N/A* ❌

Reachable
CVE-2022-0155 Medium 6.5 Not Defined 0.2% follow-redirects-1.13.3.tgz Transitive 5.0.0 ✅

Reachable
CVE-2022-0536 Low 2.6 Not Defined 0.1% follow-redirects-1.13.3.tgz Transitive 5.0.0 ✅

Reachable
WS-2021-0153 Critical 9.8 Not Defined ejs-2.7.4.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2023-42282 Critical 9.8 Not Defined 0.1% ip-1.1.5.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-37601 Critical 9.8 Not Defined 1.0% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2022-29078 Critical 9.8 Not Defined 41.3% ejs-2.7.4.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-0691 Critical 9.8 Not Defined 0.4% url-parse-1.5.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-42740 Critical 9.8 Not Defined 0.6% shell-quote-1.7.2.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3918 Critical 9.8 Not Defined 0.5% json-schema-0.2.3.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3757 Critical 9.8 Not Defined 0.3% immer-8.0.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2023-45133 Critical 9.3 Not Defined 0.1% traverse-7.13.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-48949 Critical 9.1 Not Defined 0.1% elliptic-6.5.4.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-29415 Critical 9.1 Not Defined ip-1.1.5.tgz Transitive N/A* ❌

Unreachable
CVE-2022-0686 Critical 9.1 Not Defined 0.2% url-parse-1.5.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-33883 High 8.8 Not Defined 0.1% ejs-2.7.4.tgz Transitive N/A* ❌

Unreachable
CVE-2021-37713 High 8.2 Not Defined 0.1% tar-6.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-37712 High 8.2 Not Defined 0.1% tar-6.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-37701 High 8.2 Not Defined 0.1% tar-6.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-32804 High 8.2 Not Defined 0.70000005% tar-6.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-32803 High 8.2 Not Defined 0.70000005% tar-6.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-1650 High 8.1 Not Defined 0.4% eventsource-1.0.7.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-43138 High 7.8 Not Defined 0.2% async-2.6.3.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23386 High 7.7 Not Defined 0.1% dns-packet-1.3.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-4068 High 7.5 Not Defined 0.0% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2024-37890 High 7.5 Not Defined 0.0% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2022-38900 High 7.5 Not Defined 0.4% decode-uri-component-0.2.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-37603 High 7.5 Not Defined 0.70000005% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2022-37599 High 7.5 Not Defined 0.3% loader-utils-2.0.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-3517 High 7.5 Not Defined 0.2% minimatch-3.0.4.tgz Transitive N/A* ❌

Unreachable
CVE-2022-24999 High 7.5 Not Defined 1.9% qs-6.5.2.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-24772 High 7.5 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-24771 High 7.5 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3807 High 7.5 Not Defined 0.4% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2021-3803 High 7.5 Not Defined 0.4% nth-check-1.0.2.tgz Transitive N/A* ❌

Unreachable
CVE-2021-3777 High 7.5 Not Defined 0.1% tmpl-1.0.4.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-29059 High 7.5 Not Defined 0.4% is-svg-3.0.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-28092 High 7.5 Not Defined 0.2% is-svg-3.0.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-27290 High 7.5 Not Defined 0.2% ssri-6.0.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23424 High 7.5 Proof of concept 0.2% ansi-html-0.0.7.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-29180 High 7.4 Not Defined 0.0% webpack-dev-middleware-3.7.3.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-46175 High 7.1 Not Defined 1.0% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
WS-2022-0008 Medium 6.6 Not Defined node-forge-0.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-28863 Medium 6.5 Not Defined 0.0% tar-6.1.0.tgz Transitive N/A* ❌

Unreachable
CVE-2023-46234 Medium 6.5 Not Defined 0.1% browserify-sign-4.2.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2023-26136 Medium 6.5 Proof of concept 0.3% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2024-43788 Medium 6.4 Not Defined 0.1% webpack-4.44.2.tgz Transitive N/A* ❌

Unreachable
CVE-2024-47068 Medium 6.1 Not Defined 0.1% rollup-1.32.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2023-28155 Medium 6.1 Not Defined 0.1% request-2.88.2.tgz Transitive N/A* ❌

Unreachable
CVE-2022-0122 Medium 6.1 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23436 Medium 5.6 Proof of concept 0.6% immer-8.0.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-4067 Medium 5.3 Not Defined 0.0% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2023-44270 Medium 5.3 Not Defined 0.1% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2023-26115 Medium 5.3 Proof of concept 0.1% word-wrap-1.2.3.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-25883 Medium 5.3 Proof of concept 0.2% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2022-25858 Medium 5.3 Not Defined 0.3% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2022-24773 Medium 5.3 Not Defined 0.1% node-forge-0.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-0639 Medium 5.3 Not Defined 0.1% url-parse-1.5.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-0512 Medium 5.3 Not Defined 0.1% url-parse-1.5.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3664 Medium 5.3 Not Defined 0.1% url-parse-1.5.1.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-32640 Medium 5.3 Not Defined 0.2% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2021-23382 Medium 5.3 Not Defined 0.2% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2021-23368 Medium 5.3 Not Defined 0.5% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2021-23364 Medium 5.3 Proof of concept 0.2% detected in multiple dependencies Transitive 5.0.0 ✅

Unreachable
CVE-2021-23362 Medium 5.3 Proof of concept 0.3% hosted-git-info-2.8.4.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23343 Medium 5.3 Not Defined 0.3% path-parse-1.0.6.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2020-28469 Medium 5.3 Not Defined 1.2% glob-parent-3.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23566 Medium 4.0 Proof of concept 0.1% nanoid-3.1.22.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-27088 Low 0.0 Not Defined 0.0% es5-ext-0.10.53.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2024-21538 High 7.5 Proof of concept 0.0% detected in multiple dependencies Transitive N/A* ❌
CVE-2024-21536 High 7.5 Proof of concept 0.1% http-proxy-middleware-0.19.1.tgz Transitive N/A* ❌
CVE-2024-48948 Medium 4.8 Not Defined 0.0% elliptic-6.5.4.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (12 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2023-26159 ### Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - http-proxy-middleware-0.19.1.tgz - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.3.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` follow-redirects-1.13.3/index.js (Application) -> axios-0.21.1/lib/adapters/http.js (Extension) -> axios-0.21.1/lib/defaults.js (Extension) -> axios-0.21.1/lib/axios.js (Extension) -> axios-0.21.1/index.js (Extension) -> ❌ insights-dashboard-sample-0.1.1/src/index.js (Vulnerable Component) ```

### Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

### Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 0.1%

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-28849 ### Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - http-proxy-middleware-0.19.1.tgz - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.3.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` follow-redirects-1.13.3/index.js (Application) -> axios-0.21.1/lib/adapters/http.js (Extension) -> axios-0.21.1/lib/defaults.js (Extension) -> axios-0.21.1/lib/axios.js (Extension) -> axios-0.21.1/index.js (Extension) -> ❌ insights-dashboard-sample-0.1.1/src/index.js (Vulnerable Component) ```

### Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2022-0155 ### Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - http-proxy-middleware-0.19.1.tgz - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.3.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` follow-redirects-1.13.3/index.js (Application) -> axios-0.21.1/lib/adapters/http.js (Extension) -> axios-0.21.1/lib/defaults.js (Extension) -> axios-0.21.1/lib/axios.js (Extension) -> axios-0.21.1/index.js (Extension) -> ❌ insights-dashboard-sample-0.1.1/src/index.js (Vulnerable Component) ```

### Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0536 ### Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - http-proxy-middleware-0.19.1.tgz - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.13.3.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis This vulnerability is potentially reachable ``` follow-redirects-1.13.3/index.js (Application) -> axios-0.21.1/lib/adapters/http.js (Extension) -> axios-0.21.1/lib/defaults.js (Extension) -> axios-0.21.1/lib/axios.js (Extension) -> axios-0.21.1/index.js (Extension) -> ❌ insights-dashboard-sample-0.1.1/src/index.js (Vulnerable Component) ```

### Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 3 Score Details (2.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2021-0153 ### Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - workbox-webpack-plugin-5.1.4.tgz - workbox-build-5.1.4.tgz - rollup-plugin-off-main-thread-1.4.2.tgz - :x: **ejs-2.7.4.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

### Threat Assessment

Exploit Maturity: Not Defined

EPSS:

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution (ejs): 3.1.6

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-42282 ### Vulnerable Library - ip-1.1.5.tgz

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - :x: **ip-1.1.5.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-37601 ### Vulnerable Libraries - loader-utils-1.4.0.tgz, loader-utils-1.2.3.tgz, loader-utils-2.0.0.tgz

### loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/html-webpack-plugin/node_modules/loader-utils/package.json,/node_modules/webpack/node_modules/loader-utils/package.json,/node_modules/babel-loader/node_modules/loader-utils/package.json,/node_modules/mini-css-extract-plugin/node_modules/loader-utils/package.json,/node_modules/postcss-loader/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - html-webpack-plugin-4.5.0.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library) ### loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/resolve-url-loader/node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library) ### loader-utils-2.0.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - resolve-url-loader-3.1.2.tgz - adjust-sourcemap-loader-3.0.0.tgz - :x: **loader-utils-2.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: 2022-10-12

URL: CVE-2022-37601

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 1.0%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-29078 ### Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - workbox-webpack-plugin-5.1.4.tgz - workbox-build-5.1.4.tgz - rollup-plugin-off-main-thread-1.4.2.tgz - :x: **ejs-2.7.4.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 41.3%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution (ejs): 3.1.7

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0691 ### Vulnerable Library - url-parse-1.5.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - webpack-dev-server-3.11.1.tgz - sockjs-client-1.5.0.tgz - :x: **url-parse-1.5.1.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-42740 ### Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - react-dev-utils-11.0.4.tgz - :x: **shell-quote-1.7.2.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.6%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-3918 ### Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - jest-26.6.0.tgz - jest-cli-26.6.3.tgz - jest-config-26.6.3.tgz - jest-environment-jsdom-26.6.2.tgz - jsdom-16.5.1.tgz - request-2.88.2.tgz - http-signature-1.2.0.tgz - jsprim-1.4.1.tgz - :x: **json-schema-0.2.3.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.5%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-3757 ### Vulnerable Library - immer-8.0.1.tgz

Create your next immutable state by mutating the current one

Library home page: https://registry.npmjs.org/immer/-/immer-8.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/immer/package.json

Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - react-dev-utils-11.0.4.tgz - :x: **immer-8.0.1.tgz** (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

### Reachability Analysis

The vulnerable code is unreachable

### Vulnerability Details

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-09-02

URL: CVE-2021-3757

### Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.3%

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/

Release Date: 2021-09-02

Fix Resolution (immer): 9.0.6

Direct dependency fix Resolution (react-scripts): 5.0.0

:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

mend-for-github-com[bot] commented 1 year ago

:information_source: This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.