search

turkdevops / playwright

Node.js library to automate Chromium, Firefox and WebKit with a single API
https://playwright.dev
Apache License 2.0
0 stars 0 forks source link

CVE-2016-10538 (Low) detected in cli-0.4.5.tgz - autoclosed #14

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

CVE-2016-10538 - Low Severity Vulnerability

Vulnerable Library - cli-0.4.5.tgz

A tool for rapidly building command line apps

Library home page: https://registry.npmjs.org/cli/-/cli-0.4.5.tgz

Path to dependency file: playwright/package.json

Path to vulnerable library: playwright/node_modules/cli/package.json

Dependency Hierarchy: - socksv5-0.0.6.tgz (Root Library) - ipv6-3.1.1.tgz - :x: **cli-0.4.5.tgz** (Vulnerable Library)

Found in HEAD commit: 3fa99509b24c58adcc2e4747e5d2e201eb736502

Found in base branch: master

Vulnerability Details

The package `node-cli` before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

Publish Date: 2018-05-31

URL: CVE-2016-10538

CVSS 3 Score Details (3.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: Low - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10538

Release Date: 2018-05-31

Fix Resolution: 1.0.0

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.