Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

react-scripts-3.0.1.tgz: 97 vulnerabilities (highest severity is: 9.8) reachable #24

Open
mend-for-github-com bot opened this issue Aug 30, 2023 · 0 comments
Open

react-scripts-3.0.1.tgz: 97 vulnerabilities (highest severity is: 9.8) reachable #24

mend-for-github-com bot opened this issue Aug 30, 2023 · 0 comments
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend

Comments

@mend-for-github-com
Copy link

mend-for-github-com bot commented Aug 30, 2023 •
edited

Vulnerable Library - react-scripts-3.0.1.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/immer/package.json

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (react-scripts version) Remediation Possible** Reachability
CVE-2022-24999 High 7.5 Not Defined 0.9% detected in multiple dependencies Transitive 3.1.0 ✅

Reachable
CVE-2024-28849 Medium 6.5 Not Defined 0.0% follow-redirects-1.5.10.tgz Transitive N/A* ❌

Reachable
CVE-2022-0155 Medium 6.5 Not Defined 0.1% follow-redirects-1.5.10.tgz Transitive 3.1.0 ✅

Reachable
CVE-2024-29041 Medium 6.1 Not Defined 0.0% express-4.17.1.tgz Transitive N/A* ❌

Reachable
CVE-2023-26159 Medium 6.1 Not Defined 0.1% follow-redirects-1.5.10.tgz Transitive 3.1.0 ✅

Reachable
CVE-2022-0536 Medium 5.9 Not Defined 0.1% follow-redirects-1.5.10.tgz Transitive 3.1.0 ✅

Reachable
MSC-2023-16609 Critical 9.8 High fsevents-1.2.9.tgz Transitive N/A* ❌

Unreachable
CVE-2023-45311 Critical 9.8 Not Defined 0.4% fsevents-1.2.9.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2023-42282 Critical 9.8 Not Defined 0.1% ip-1.1.5.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2023-26136 Critical 9.8 Not Defined 0.1% detected in multiple dependencies Transitive 4.0.0 ✅

Unreachable
CVE-2022-37601 Critical 9.8 Not Defined 1.0% loader-utils-1.2.3.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2022-37598 Critical 9.8 Not Defined 0.5% uglify-js-3.4.10.tgz Transitive 3.3.1 ✅

Unreachable
CVE-2022-0691 Critical 9.8 Not Defined 0.3% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-42740 Critical 9.8 Not Defined 0.2% shell-quote-1.7.2.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3918 Critical 9.8 Not Defined 0.4% json-schema-0.2.3.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-3757 Critical 9.8 Not Defined 0.3% immer-1.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-26707 Critical 9.8 Not Defined 0.6% merge-deep-3.0.2.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-23436 Critical 9.8 Not Defined 0.4% immer-1.10.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23383 Critical 9.8 Not Defined 3.3% handlebars-4.4.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-23369 Critical 9.8 Not Defined 14.900001% handlebars-4.4.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-7774 Critical 9.8 Not Defined 30.4% y18n-4.0.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-1650 Critical 9.3 Not Defined 0.2% eventsource-1.0.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2024-29415 Critical 9.1 Not Defined ip-1.1.5.tgz Transitive N/A* ❌

Unreachable
CVE-2022-0686 Critical 9.1 Not Defined 0.2% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2023-45133 High 8.8 Not Defined 0.1% traverse-7.6.2.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-46175 High 8.8 Not Defined 0.6% detected in multiple dependencies Transitive 3.1.0 ✅

Unreachable
CVE-2021-37713 High 8.6 Not Defined 0.1% tar-4.4.8.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-37712 High 8.6 Not Defined 0.1% tar-4.4.8.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-37701 High 8.6 Not Defined 0.1% tar-4.4.8.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-32804 High 8.1 Not Defined 0.70000005% tar-4.4.8.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-32803 High 8.1 Not Defined 0.70000005% tar-4.4.8.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-7660 High 8.1 Not Defined 1.0% serialize-javascript-1.9.1.tgz Transitive 3.4.3 ✅

Unreachable
CVE-2020-36604 High 8.1 Not Defined 0.2% hoek-8.2.5.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2019-20920 High 8.1 Not Defined 0.70000005% handlebars-4.4.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-13822 High 7.7 Not Defined 0.4% elliptic-6.5.1.tgz Transitive 3.1.0 ✅

Unreachable
WS-2021-0152 High 7.5 Not Defined color-string-1.5.3.tgz Transitive 3.1.0 ✅

Unreachable
WS-2020-0450 High 7.5 Not Defined handlebars-4.4.1.tgz Transitive 3.1.0 ✅

Unreachable
WS-2020-0091 High 7.5 Not Defined http-proxy-1.18.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2024-4068 High 7.5 Not Defined 0.0% braces-2.3.2.tgz Transitive N/A* ❌

Unreachable
CVE-2023-46234 High 7.5 Not Defined 0.1% browserify-sign-4.0.4.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-38900 High 7.5 Not Defined 0.2% decode-uri-component-0.2.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-37620 High 7.5 Not Defined 0.1% html-minifier-3.5.21.tgz Transitive N/A* ❌

Unreachable
CVE-2022-37603 High 7.5 Not Defined 0.70000005% loader-utils-1.2.3.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2022-3517 High 7.5 Not Defined 0.2% minimatch-3.0.4.tgz Transitive N/A* ❌

Unreachable
CVE-2022-25883 High 7.5 Not Defined 0.1% detected in multiple dependencies Transitive N/A* ❌

Unreachable
CVE-2022-25858 High 7.5 Not Defined 0.2% terser-3.17.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-24772 High 7.5 Not Defined 0.1% node-forge-0.9.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-24771 High 7.5 Not Defined 0.1% node-forge-0.9.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-3807 High 7.5 Not Defined 0.4% detected in multiple dependencies Transitive 3.1.0 ✅

Unreachable
CVE-2021-3803 High 7.5 Not Defined 0.2% nth-check-1.0.2.tgz Transitive N/A* ❌

Unreachable
CVE-2021-3777 High 7.5 Not Defined 0.1% tmpl-1.0.4.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-29059 High 7.5 Not Defined 0.4% is-svg-3.0.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-28092 High 7.5 Not Defined 0.2% is-svg-3.0.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-27290 High 7.5 Not Defined 0.2% ssri-6.0.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-23424 High 7.5 Not Defined 0.2% ansi-html-0.0.7.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23382 High 7.5 Not Defined 0.2% postcss-7.0.18.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2021-23343 High 7.5 Not Defined 0.3% path-parse-1.0.6.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-7662 High 7.5 Not Defined 0.2% websocket-extensions-0.1.3.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-28477 High 7.5 Not Defined 0.2% immer-1.10.0.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2020-28469 High 7.5 Not Defined 1.2% glob-parent-3.1.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2019-20922 High 7.5 Not Defined 0.2% handlebars-4.4.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2019-20149 High 7.5 Not Defined 0.1% kind-of-6.0.2.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2024-29180 High 7.4 Not Defined 0.0% webpack-dev-middleware-3.7.2.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2020-8203 High 7.4 Not Defined 1.0% lodash-4.17.15.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-8116 High 7.3 Not Defined 0.2% dot-prop-4.2.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-7720 High 7.3 Not Defined 0.2% node-forge-0.9.0.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-23337 High 7.2 Not Defined 0.6% lodash-4.17.15.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-28498 Medium 6.8 Not Defined 0.1% elliptic-6.5.1.tgz Transitive 3.1.0 ✅

Unreachable
WS-2022-0008 Medium 6.6 Not Defined node-forge-0.9.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23386 Medium 6.5 Not Defined 0.1% dns-packet-1.3.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2023-28155 Medium 6.1 Not Defined 0.1% request-2.88.0.tgz Transitive N/A* ❌

Unreachable
CVE-2022-0122 Medium 6.1 Not Defined 0.1% node-forge-0.9.0.tgz Transitive 5.0.0 ✅

Unreachable
WS-2019-0427 Medium 5.9 Not Defined elliptic-6.5.1.tgz Transitive 3.1.0 ✅

Unreachable
WS-2019-0424 Medium 5.9 Not Defined elliptic-6.5.1.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-24033 Medium 5.6 Not Defined 0.2% react-dev-utils-9.0.4.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2020-7789 Medium 5.6 Not Defined 0.2% node-notifier-5.4.3.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-15366 Medium 5.6 Not Defined 0.3% ajv-6.10.2.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2019-16769 Medium 5.4 Not Defined 0.1% serialize-javascript-1.9.1.tgz Transitive 3.3.0 ✅

Unreachable
CVE-2024-4067 Medium 5.3 Not Defined 0.0% micromatch-3.1.10.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-24773 Medium 5.3 Not Defined 0.1% node-forge-0.9.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2022-0639 Medium 5.3 Not Defined 0.1% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2022-0512 Medium 5.3 Not Defined 0.1% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-3664 Medium 5.3 Not Defined 0.1% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-32640 Medium 5.3 Not Defined 0.2% detected in multiple dependencies Transitive 3.1.0 ✅

Unreachable
CVE-2021-29060 Medium 5.3 Not Defined 0.2% color-string-1.5.3.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-27515 Medium 5.3 Not Defined 0.2% url-parse-1.4.7.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2021-23368 Medium 5.3 Not Defined 0.5% postcss-7.0.18.tgz Transitive 4.0.0 ✅

Unreachable
CVE-2021-23364 Medium 5.3 Not Defined 0.2% browserslist-4.7.0.tgz Transitive 5.0.0 ✅

Unreachable
CVE-2021-23362 Medium 5.3 Not Defined 0.3% hosted-git-info-2.8.4.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2020-7693 Medium 5.3 Not Defined 0.8% sockjs-0.3.19.tgz Transitive 3.4.2 ✅

Unreachable
CVE-2020-7608 Medium 5.3 Not Defined 0.0% detected in multiple dependencies Transitive 3.4.2 ✅

Unreachable
CVE-2020-28500 Medium 5.3 Not Defined 0.2% lodash-4.17.15.tgz Transitive 3.1.0 ✅

Unreachable
CVE-2017-16137 Low 3.7 Not Defined 0.3% detected in multiple dependencies Transitive 3.1.0 ✅

Unreachable
CVE-2021-44906 Critical 9.8 Not Defined 1.2% detected in multiple dependencies Transitive 3.1.0 ✅
CVE-2020-7788 Critical 9.8 Not Defined 1.2% ini-1.3.5.tgz Transitive 3.1.0 ❌
CVE-2024-28863 Medium 6.5 Not Defined 0.0% tar-4.4.8.tgz Transitive N/A* ❌
CVE-2020-7598 Medium 5.6 Not Defined 0.1% detected in multiple dependencies Transitive 3.1.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (8 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2022-24999

Vulnerable Libraries - qs-6.7.0.tgz, qs-6.5.2.tgz

qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/express/node_modules/qs/package.json,/ui/node_modules/body-parser/node_modules/qs/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • express-4.17.1.tgz
        • ❌ qs-6.7.0.tgz (Vulnerable Library)

qs-6.5.2.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.5.2.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/qs/package.json,/api/node_modules/qs/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • jest-environment-jsdom-fourteen-0.1.0.tgz
      • jsdom-14.1.0.tgz
        • request-2.88.0.tgz
          • ❌ qs-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

qs-6.7.0/lib/parse.js (Application)
  -> qs-6.7.0/lib/index.js (Extension)
   -> body-parser-1.19.0/lib/types/urlencoded.js (Extension)
    -> body-parser-1.19.0/index.js (Extension)
     -> ❌ api-0.0.0/src/app.js (Vulnerable Component)

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: qs@6.9.7" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.9%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (react-scripts): 3.1.0

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (react-scripts): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28849

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • http-proxy-middleware-0.19.1.tgz
        • http-proxy-1.18.0.tgz
          • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

follow-redirects-1.5.10/index.js (Application)
  -> axios-0.19.0/lib/adapters/http.js (Extension)
   -> axios-0.19.0/lib/defaults.js (Extension)
    -> axios-0.19.0/lib/axios.js (Extension)
     -> axios-0.19.0/index.js (Extension)
      -> ❌ ui-0.1.0/src/login/ValidatedSignUpForm.test.js (Vulnerable Component)

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • http-proxy-middleware-0.19.1.tgz
        • http-proxy-1.18.0.tgz
          • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

follow-redirects-1.5.10/index.js (Application)
  -> axios-0.19.0/lib/adapters/http.js (Extension)
   -> axios-0.19.0/lib/defaults.js (Extension)
    -> axios-0.19.0/lib/axios.js (Extension)
     -> axios-0.19.0/index.js (Extension)
      -> ❌ ui-0.1.0/src/login/ValidatedSignUpForm.test.js (Vulnerable Component)

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (react-scripts): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29041

Vulnerable Library - express-4.17.1.tgz

Fast, unopinionated, minimalist web framework

Library home page: https://registry.npmjs.org/express/-/express-4.17.1.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/express/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • ❌ express-4.17.1.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

express-4.17.1/lib/response.js (Application)
  -> express-4.17.1/lib/express.js (Extension)
   -> express-4.17.1/index.js (Extension)
    -> ❌ api-0.0.0/src/routes/index.js (Vulnerable Component)

Vulnerability Details

Express.js minimalist web framework for node. Versions of Express.js prior to 4.19.0 and all pre-release alpha and beta versions of 5.0 are affected by an open redirect vulnerability using malformed URLs. When a user of Express performs a redirect using a user-provided URL Express performs an encode using encodeurl on the contents before passing it to the location header. This can cause malformed URLs to be evaluated in unexpected ways by common redirect allow list implementations in Express applications, leading to an Open Redirect via bypass of a properly implemented allow list. The main method impacted is res.location() but this is also called from within res.redirect(). The vulnerability is fixed in 4.19.2 and 5.0.0-beta.3.

Publish Date: 2024-03-25

URL: CVE-2024-29041

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rv95-896h-c2vc

Release Date: 2024-03-25

Fix Resolution: express - 4.19.0

CVE-2023-26159

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • http-proxy-middleware-0.19.1.tgz
        • http-proxy-1.18.0.tgz
          • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

follow-redirects-1.5.10/index.js (Application)
  -> axios-0.19.0/lib/adapters/http.js (Extension)
   -> axios-0.19.0/lib/defaults.js (Extension)
    -> axios-0.19.0/lib/axios.js (Extension)
     -> axios-0.19.0/index.js (Extension)
      -> ❌ ui-0.1.0/src/login/ValidatedSignUpForm.test.js (Vulnerable Component)

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (react-scripts): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • webpack-dev-server-3.2.1.tgz
      • http-proxy-middleware-0.19.1.tgz
        • http-proxy-1.18.0.tgz
          • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

This vulnerability is potentially reachable

follow-redirects-1.5.10/index.js (Application)
  -> axios-0.19.0/lib/adapters/http.js (Extension)
   -> axios-0.19.0/lib/defaults.js (Extension)
    -> axios-0.19.0/lib/axios.js (Extension)
     -> axios-0.19.0/index.js (Extension)
      -> ❌ ui-0.1.0/src/login/ValidatedSignUpForm.test.js (Vulnerable Component)

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (react-scripts): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

MSC-2023-16609

Vulnerable Library - fsevents-1.2.9.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • babel-jest-24.9.0.tgz
      • transform-24.9.0.tgz
        • jest-haste-map-24.9.0.tgz
          • ❌ fsevents-1.2.9.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.

Publish Date: 2023-09-20

URL: MSC-2023-16609

Threat Assessment

Exploit Maturity: High

EPSS:

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2023-45311

Vulnerable Library - fsevents-1.2.9.tgz

Native Access to Mac OS-X FSEvents

Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz

Path to dependency file: /ui/package.json

Path to vulnerable library: /ui/package.json

Dependency Hierarchy:

  • react-scripts-3.0.1.tgz (Root Library)
    • babel-jest-24.9.0.tgz
      • transform-24.9.0.tgz
        • jest-haste-map-24.9.0.tgz
          • ❌ fsevents-1.2.9.tgz (Vulnerable Library)

Found in HEAD commit: c86ac37edecda28046d3157739e16c0e14c30fce

Found in base branch: master

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.

Publish Date: 2023-10-06

URL: CVE-2023-45311

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311

Release Date: 2023-10-06

Fix Resolution (fsevents): 1.2.11

Direct dependency fix Resolution (react-scripts): 3.1.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.
@mend-for-github-com mend-for-github-com bot added the Mend: dependency security vulnerability Security vulnerability detected by Mend label Aug 30, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Aug 30, 2023
Closed
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 78 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 80 vulnerabilities (highest severity is: 9.8) Nov 15, 2023
@mend-for-github-com mend-for-github-com bot mentioned this issue Nov 29, 2023
Closed
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 80 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 81 vulnerabilities (highest severity is: 9.8) Dec 5, 2023
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 81 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 83 vulnerabilities (highest severity is: 9.8) Feb 29, 2024
@mend-for-github-com mend-for-github-com bot mentioned this issue Feb 29, 2024
Open
1 task
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 83 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 84 vulnerabilities (highest severity is: 9.8) Mar 3, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 84 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 90 vulnerabilities (highest severity is: 9.8) Mar 3, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 90 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 89 vulnerabilities (highest severity is: 9.8) Mar 23, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 89 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 90 vulnerabilities (highest severity is: 9.8) Apr 8, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 90 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 91 vulnerabilities (highest severity is: 9.8) Apr 9, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 91 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 92 vulnerabilities (highest severity is: 9.8) Apr 17, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 92 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 93 vulnerabilities (highest severity is: 9.8) Apr 19, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 93 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 94 vulnerabilities (highest severity is: 9.8) Apr 25, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 94 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 96 vulnerabilities (highest severity is: 9.8) May 15, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 96 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 97 vulnerabilities (highest severity is: 9.8) Jun 2, 2024
@mend-for-github-com mend-for-github-com bot changed the title react-scripts-3.0.1.tgz: 97 vulnerabilities (highest severity is: 9.8) react-scripts-3.0.1.tgz: 97 vulnerabilities (highest severity is: 9.8) reachable Jun 3, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Mend: dependency security vulnerability Security vulnerability detected by Mend
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
0 participants