CVE-2020-15095 (Medium) detected in npm-6.9.0.tgz - autoclosed

[mend-bolt-for-github[bot]]

CVE-2020-15095 - Medium Severity Vulnerability

Vulnerable Library - npm-6.9.0.tgz

a package manager for JavaScript

Library home page: https://registry.npmjs.org/npm/-/npm-6.9.0.tgz

Path to dependency file: stripe-distinct-usage-tracking/package.json

Path to vulnerable library: stripe-distinct-usage-tracking/node_modules/npm

Dependency Hierarchy: - semantic-release-15.13.18.tgz (Root Library) - npm-5.1.7.tgz - :x: **npm-6.9.0.tgz** (Vulnerable Library)

Found in HEAD commit: 288b1c7d0d0acd2be479cdcac3dd10a64fc6e714

Vulnerability Details

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.

Publish Date: 2020-07-07

URL: CVE-2020-15095

CVSS 3 Score Details (4.4)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp

Release Date: 2020-07-07

Fix Resolution: npm - 6.14.6

---

Step up your Open Source Security Game with WhiteSource here

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #138

[mend-bolt-for-github[bot]]

:information_source: This issue was automatically closed by WhiteSource because it is a duplicate of an existing issue: #138