attesch/PrestaShop

CVE-2019-15657 (Critical) detected in eslint-utils-1.3.1.tgz

Opened this issue · 0 comments

mend-bolt-for-github commented

CVE-2019-15657 - Critical Severity Vulnerability

Vulnerable Library - eslint-utils-1.3.1.tgz

Utilities for ESLint plugins.

Library home page: https://registry.npmjs.org/eslint-utils/-/eslint-utils-1.3.1.tgz

Path to dependency file: /PrestaShop/package.json

Path to vulnerable library: /node_modules/eslint-utils/package.json

Dependency Hierarchy:

  • eslint-5.4.0.tgz (Root Library)
    • ❌ eslint-utils-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: bb7465065dfeed9f49bb99b6901ab933563af739

Found in base branch: develop

Vulnerability Details

In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.

Publish Date: 2019-08-26

URL: CVE-2019-15657

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15657

Release Date: 2020-08-24

Fix Resolution (eslint-utils): 1.4.1

Direct dependency fix Resolution (eslint): 5.5.0

Step up your Open Source Security Game with Mend here