*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
In socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
The package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Spectacular Test Runner for JavaScript.
Library home page: https://registry.npmjs.org/karma/-/karma-5.0.4.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2022-2421
### Vulnerable Library - socket.io-parser-3.2.0.tgzsocket.io protocol parser
Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.2.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - :x: **socket.io-parser-3.2.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsDue to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Publish Date: 2022-10-25
URL: CVE-2022-2421
### CVSS 3 Score Details (10.0)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-qm95-pgcg-qqfq
Release Date: 2022-10-26
Fix Resolution (socket.io-parser): 3.3.3
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-31597
### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - socket.io-client-2.1.1.tgz - engine.io-client-3.2.1.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Publish Date: 2021-04-22
URL: CVE-2021-31597
### CVSS 3 Score Details (9.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597
Release Date: 2021-04-22
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
WS-2020-0443
### Vulnerable Library - socket.io-2.1.1.tgznode.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **socket.io-2.1.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsIn socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".
Publish Date: 2020-02-20
URL: WS-2020-0443
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://hackerone.com/reports/931197
Release Date: 2020-02-20
Fix Resolution (socket.io): 2.4.0
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-28502
### Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - socket.io-client-2.1.1.tgz - engine.io-client-3.2.1.tgz - :x: **xmlhttprequest-ssl-1.5.5.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThis affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Publish Date: 2021-03-05
URL: CVE-2020-28502
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-h4j5-c7cj-74xg
Release Date: 2021-03-05
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-45590
### Vulnerable Library - body-parser-1.19.0.tgzNode.js body parsing middleware
Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **body-parser-1.19.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsbody-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Publish Date: 2024-09-10
URL: CVE-2024-45590
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
Release Date: 2024-09-10
Fix Resolution: body-parser - 1.20.3
CVE-2024-37890
### Vulnerable Library - ws-3.3.3.tgzSimple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-3.3.3.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - engine.io-3.2.1.tgz - :x: **ws-3.3.3.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
Publish Date: 2024-06-17
URL: CVE-2024-37890
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
Release Date: 2024-06-17
Fix Resolution (ws): 5.2.4
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-3807
### Vulnerable Library - ansi-regex-5.0.0.tgzRegular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - yargs-15.3.1.tgz - cliui-6.0.0.tgz - strip-ansi-6.0.0.tgz - :x: **ansi-regex-5.0.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-93q8-gq69-wqmw
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 5.0.1
Direct dependency fix Resolution (karma): 5.0.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-27292
### Vulnerable Library - ua-parser-js-0.7.21.tgzLightweight JavaScript-based user-agent string parser
Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.
Publish Date: 2021-03-17
URL: CVE-2021-27292
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27292
Release Date: 2021-03-17
Fix Resolution (ua-parser-js): 0.7.24
Direct dependency fix Resolution (karma): 6.0.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-7793
### Vulnerable Library - ua-parser-js-0.7.21.tgzLightweight JavaScript-based user-agent string parser
Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package ua-parser-js before 0.7.23 are vulnerable to Regular Expression Denial of Service (ReDoS) in multiple regexes (see linked commit for more info).
Publish Date: 2020-12-11
URL: CVE-2020-7793
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-12-11
Fix Resolution (ua-parser-js): 0.7.23
Direct dependency fix Resolution (karma): 6.0.0
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-7733
### Vulnerable Library - ua-parser-js-0.7.21.tgzLightweight JavaScript-based user-agent string parser
Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.21.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **ua-parser-js-0.7.21.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.
Publish Date: 2020-09-16
URL: CVE-2020-7733
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-09-16
Fix Resolution (ua-parser-js): 0.7.22
Direct dependency fix Resolution (karma): 5.2.3
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-36049
### Vulnerable Library - socket.io-parser-3.2.0.tgzsocket.io protocol parser
Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.2.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - :x: **socket.io-parser-3.2.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailssocket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Publish Date: 2021-01-07
URL: CVE-2020-36049
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-xfhh-g9f5-x4m4
Release Date: 2021-01-07
Fix Resolution (socket.io-parser): 3.3.2
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-36048
### Vulnerable Library - engine.io-3.2.1.tgzThe realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server
Library home page: https://registry.npmjs.org/engine.io/-/engine.io-3.2.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - :x: **engine.io-3.2.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsEngine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Publish Date: 2021-01-07
URL: CVE-2020-36048
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36048
Release Date: 2021-01-07
Fix Resolution (engine.io): 3.6.0
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-38355
### Vulnerable Library - socket.io-2.1.1.tgznode.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **socket.io-2.1.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsSocket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
Publish Date: 2024-06-19
URL: CVE-2024-38355
### CVSS 3 Score Details (7.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
Release Date: 2024-06-19
Fix Resolution (socket.io): 4.6.2
Direct dependency fix Resolution (karma): 6.3.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2023-26159
### Vulnerable Library - follow-redirects-1.7.0.tgzHTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.7.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.7.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsVersions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Publish Date: 2024-01-02
URL: CVE-2023-26159
### CVSS 3 Score Details (7.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159
Release Date: 2024-01-02
Fix Resolution (follow-redirects): 1.15.4
Direct dependency fix Resolution (karma): 5.0.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-41940
### Vulnerable Library - engine.io-3.2.1.tgzThe realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server
Library home page: https://registry.npmjs.org/engine.io/-/engine.io-3.2.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - socket.io-2.1.1.tgz - :x: **engine.io-3.2.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsEngine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
Publish Date: 2022-11-22
URL: CVE-2022-41940
### CVSS 3 Score Details (7.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
Release Date: 2022-11-22
Fix Resolution (engine.io): 3.6.1
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2024-28849
### Vulnerable Library - follow-redirects-1.7.0.tgzHTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.7.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.7.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsfollow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-03-14
URL: CVE-2024-28849
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/follow-redirects/follow-redirects/security/advisories/GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
CVE-2022-0155
### Vulnerable Library - follow-redirects-1.7.0.tgzHTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.7.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.7.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailsfollow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Publish Date: 2022-01-10
URL: CVE-2022-0155
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/
Release Date: 2022-01-10
Fix Resolution (follow-redirects): 1.14.7
Direct dependency fix Resolution (karma): 5.0.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0437
### Vulnerable Library - karma-5.0.4.tgzSpectacular Test Runner for JavaScript.
Library home page: https://registry.npmjs.org/karma/-/karma-5.0.4.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - :x: **karma-5.0.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsCross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
Publish Date: 2022-02-05
URL: CVE-2022-0437
### CVSS 3 Score Details (6.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0437
Release Date: 2022-02-05
Fix Resolution: 6.3.14
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-21704
### Vulnerable Library - log4js-4.5.1.tgzPort of Log4js to work with node.
Library home page: https://registry.npmjs.org/log4js/-/log4js-4.5.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **log4js-4.5.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability Detailslog4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Publish Date: 2022-01-19
URL: CVE-2022-21704
### CVSS 3 Score Details (5.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/log4js-node/log4js-node/security/advisories/GHSA-82v2-mx6x-wq7q
Release Date: 2022-01-19
Fix Resolution (log4js): 6.4.0
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2021-23495
### Vulnerable Library - karma-5.0.4.tgzSpectacular Test Runner for JavaScript.
Library home page: https://registry.npmjs.org/karma/-/karma-5.0.4.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - :x: **karma-5.0.4.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package karma before 6.3.16 are vulnerable to Open Redirect due to missing validation of the return_url query parameter.
Publish Date: 2022-02-25
URL: CVE-2021-23495
### CVSS 3 Score Details (5.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23495
Release Date: 2022-02-25
Fix Resolution: 6.3.16
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2020-28481
### Vulnerable Library - socket.io-2.1.1.tgznode.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - :x: **socket.io-2.1.1.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsThe package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Publish Date: 2021-01-19
URL: CVE-2020-28481
### CVSS 3 Score Details (5.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28481
Release Date: 2021-01-19
Fix Resolution (socket.io): 2.4.0
Direct dependency fix Resolution (karma): 5.0.8
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
CVE-2022-0536
### Vulnerable Library - follow-redirects-1.7.0.tgzHTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.7.0.tgz
Path to dependency file: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Path to vulnerable library: /nifi-registry/nifi-registry-core/nifi-registry-web-ui/src/main/package.json
Dependency Hierarchy: - karma-5.0.4.tgz (Root Library) - http-proxy-1.18.1.tgz - :x: **follow-redirects-1.7.0.tgz** (Vulnerable Library)
Found in base branch: main
### Vulnerability DetailsImproper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
### CVSS 3 Score Details (2.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Adjacent - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution (follow-redirects): 1.14.8
Direct dependency fix Resolution (karma): 5.0.5
:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.