search

uniquelyparticular / sync-moltin-to-shipengine

This Particular example demonstrates how you can sync paid/captured order status updates from Moltin to trigger emailing generated label from ShipEngine via Webhook API.
https://uniquelyparticular.com
MIT License
3 stars 3 forks source link

WS-2019-0337 (Medium) detected in bin-links-1.1.3.tgz - autoclosed #217

Closed mend-bolt-for-github[bot] closed 2 years ago

mend-bolt-for-github[bot] commented 4 years ago

WS-2019-0337 - Medium Severity Vulnerability

Vulnerable Library - bin-links-1.1.3.tgz

JavaScript package binary linker

Library home page: https://registry.npmjs.org/bin-links/-/bin-links-1.1.3.tgz

Path to dependency file: /tmp/ws-scm/sync-moltin-to-shipengine/package.json

Path to vulnerable library: /tmp/ws-scm/sync-moltin-to-shipengine/node_modules/npm/node_modules/bin-links/package.json

Dependency Hierarchy: - semantic-release-15.13.31.tgz (Root Library) - npm-5.3.4.tgz - npm-6.13.0.tgz - :x: **bin-links-1.1.3.tgz** (Vulnerable Library)

Found in HEAD commit: 1a271b872793781f011b09e4b7b672a9e80affe2

Vulnerability Details

Arbitrary File Write vulnerability found in bin-links before 1.1.5. The package fails to restrict access to folders outside of the intended node_modules folder through the bin field. This allows attackers to create arbitrary files in the system.

Publish Date: 2019-12-17

URL: WS-2019-0337

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/npm/bin-links/commit/642cd1890d1e0ca32b5f9ceadc6a587d94a63d69

Release Date: 2019-12-17

Fix Resolution: bin-links - 1.1.5

Step up your Open Source Security Game with WhiteSource here

mend-bolt-for-github[bot] commented 2 years ago

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.