search

uniquelyparticular / stripe-distinct-usage-tracking

This Particular example demonstrates how you can track unique Usage Records for Metered Pricing Subscriptions in Stripe.
https://uniquelyparticular.com
MIT License
1 stars 1 forks source link

WS-2019-0337 (Medium) detected in bin-links-1.1.2.tgz - autoclosed #124

Closed mend-bolt-for-github[bot] closed 3 years ago

mend-bolt-for-github[bot] commented 3 years ago

WS-2019-0337 - Medium Severity Vulnerability

Vulnerable Library - bin-links-1.1.2.tgz

JavaScript package binary linker

Library home page: https://registry.npmjs.org/bin-links/-/bin-links-1.1.2.tgz

Path to dependency file: stripe-distinct-usage-tracking/package.json

Path to vulnerable library: stripe-distinct-usage-tracking/node_modules/bin-links

Dependency Hierarchy: - semantic-release-15.13.18.tgz (Root Library) - npm-5.1.7.tgz - npm-6.9.0.tgz - :x: **bin-links-1.1.2.tgz** (Vulnerable Library)

Found in HEAD commit: 288b1c7d0d0acd2be479cdcac3dd10a64fc6e714

Vulnerability Details

Arbitrary File Write vulnerability found in bin-links before 1.1.5. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system.

Publish Date: 2019-12-11

URL: WS-2019-0337

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/npm/bin-links/commit/642cd1890d1e0ca32b5f9ceadc6a587d94a63d69

Release Date: 2019-12-17

Fix Resolution: bin-links - 1.1.5

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #125

mend-bolt-for-github[bot] commented 3 years ago

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #125