Open dev-mend-for-github-com[bot] opened 2 years ago
:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.
:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.
:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.
:information_source: This issue was automatically re-opened by WhiteSource because the vulnerable library in the specific branch(es) has been detected in the WhiteSource inventory.
Vulnerable Library - grunt-cli-0.1.13.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/minimatch/package.json,/tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/node_modules/cli/node_modules/minimatch/package.json
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Vulnerabilities
Details
CVE-2019-10744
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability DetailsVersions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2016-10540
### Vulnerable Library - minimatch-0.3.0.tgza glob matcher in javascript
Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/minimatch/package.json,/tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/node_modules/cli/node_modules/minimatch/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - glob-3.2.11.tgz - :x: **minimatch-0.3.0.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability DetailsMinimatch is a minimal matching utility that works by converting glob expressions into JavaScript `RegExp` objects. The primary function, `minimatch(path, pattern)` in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the `pattern` parameter.
Publish Date: 2018-05-31
URL: CVE-2016-10540
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10540
Release Date: 2018-05-31
Fix Resolution (minimatch): 3.0.2
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2020-8203
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability DetailsPrototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
### CVSS 3 Score Details (7.4)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution (lodash): 4.17.9
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2021-23337
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability DetailsLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
### CVSS 3 Score Details (7.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2019-1010266
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability Detailslodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-17
URL: CVE-2019-1010266
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266
Release Date: 2020-09-30
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-3721
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability Detailslodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-06-07
URL: CVE-2018-3721
### CVSS 3 Score Details (6.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721
Release Date: 2018-06-07
Fix Resolution (lodash): 4.17.5
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issueCVE-2018-16487
### Vulnerable Library - lodash-2.4.2.tgzA utility library delivering consistency, customization, performance, & extras.
Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz
Path to dependency file: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/package.json
Path to vulnerable library: /tmp/ws-scm/SAST-coldfusion-project3/assets/reveal.js/plugin/multiplex/node_modules/lodash/package.json
Dependency Hierarchy: - grunt-cli-0.1.13.tgz (Root Library) - findup-sync-0.1.3.tgz - :x: **lodash-2.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: c2eefd95e48e1db14889cdc88ab5b97aa52b5376
Found in base branch: main
### Vulnerability DetailsA prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
### CVSS 3 Score Details (5.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487
Release Date: 2019-02-01
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (grunt-cli): 1.0.0-rc1
:rescue_worker_helmet: Automatic Remediation is available for this issue:rescue_worker_helmet: Automatic Remediation is available for this issue.