search

samq-starkcorp / JS-Demo

Apache License 2.0
0 stars 0 forks source link

selenium-webdriver-4.1.1.tgz: 1 vulnerabilities (highest severity is: 7.3) - autoclosed #52

Closed mend-for-github-com[bot] closed 1 year ago

mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - selenium-webdriver-4.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jszip/package.json

Found in HEAD commit: 39cc0e9c4687f38582409ab13a46554e22ef1658

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (selenium-webdriver version) Remediation Possible**
CVE-2022-48285 High 7.3 jszip-3.7.1.tgz Transitive 4.1.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-48285 ### Vulnerable Library - jszip-3.7.1.tgz

Create, read and edit .zip files with JavaScript http://stuartk.com/jszip

Library home page: https://registry.npmjs.org/jszip/-/jszip-3.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jszip/package.json

Dependency Hierarchy: - selenium-webdriver-4.1.1.tgz (Root Library) - :x: **jszip-3.7.1.tgz** (Vulnerable Library)

Found in HEAD commit: 39cc0e9c4687f38582409ab13a46554e22ef1658

Found in base branch: main

### Vulnerability Details

loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. Mend Note: Converted from WS-2023-0004, on 2023-02-01.

Publish Date: 2023-01-29

URL: CVE-2022-48285

### CVSS 3 Score Details (7.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2023-01-29

Fix Resolution (jszip): 3.8.0

Direct dependency fix Resolution (selenium-webdriver): 4.1.2

In order to enable automatic remediation, please create workflow rules

In order to enable automatic remediation for this issue, please create workflow rules

mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.