config-conventional-9.0.1.tgz: 1 vulnerabilities (highest severity is: 7.3)
Opened this issue · 0 comments
Vulnerable Library - config-conventional-9.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dot-prop/package.json
Found in HEAD commit: e6bb75a02bdc1736d9bdac96043a42156c72da5b
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (config-conventional version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2020-8116 | 7.3 | dot-prop-3.0.0.tgz | Transitive | 10.0.0 | ❌ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-8116
Vulnerable Library - dot-prop-3.0.0.tgz
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-3.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dot-prop/package.json
Dependency Hierarchy:
- config-conventional-9.0.1.tgz (Root Library)
- conventional-changelog-conventionalcommits-4.2.3.tgz
- compare-func-1.3.2.tgz
- ❌ dot-prop-3.0.0.tgz (Vulnerable Library)
- compare-func-1.3.2.tgz
- conventional-changelog-conventionalcommits-4.2.3.tgz
Found in HEAD commit: e6bb75a02bdc1736d9bdac96043a42156c72da5b
Found in base branch: master
Vulnerability Details
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
CVSS 3 Score Details (7.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution (dot-prop): 4.2.1
Direct dependency fix Resolution (@commitlint/config-conventional): 10.0.0
Step up your Open Source Security Game with Mend here