CVE-2020-8158 (High) detected in typeorm-0.2.22.tgz - autoclosed

[mend-bolt-for-github[bot]]

CVE-2020-8158 - High Severity Vulnerability

Vulnerable Library - typeorm-0.2.22.tgz

Data-Mapper ORM for TypeScript, ES7, ES6, ES5. Supports MySQL, PostgreSQL, MariaDB, SQLite, MS SQL Server, Oracle, MongoDB databases.

Library home page: https://registry.npmjs.org/typeorm/-/typeorm-0.2.22.tgz

Path to dependency file: sourcegraph/lsif/package.json

Path to vulnerable library: sourcegraph/lsif/node_modules/typeorm

Dependency Hierarchy: - :x: **typeorm-0.2.22.tgz** (Vulnerable Library)

Found in HEAD commit: e8e8af042d128ed6c81ef96fe641a69ac584771b

Found in base branch: dev/seed-tool

Vulnerability Details

Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.

Publish Date: 2020-09-18

URL: CVE-2020-8158

CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8158

Release Date: 2020-07-21

Fix Resolution: 0.2.25

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.