react-scripts-4.0.3.tgz: 75 vulnerabilities (highest severity is: 9.8) reachable

[mend-for-github-com]

Vulnerable Library - react-scripts-4.0.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Vulnerabilities

CVE	Severity	CVSS	Exploit Maturity	EPSS	Dependency	Type	Fixed in (react-scripts version)	Remediation Possible**	Reachability
CVE-2023-26159	High	7.3	Proof of concept	0.1%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2024-28849	Medium	6.5	Not Defined	0.0%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2022-0155	Medium	6.5	Not Defined	0.2%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
CVE-2022-0536	Low	2.6	Not Defined	0.1%	follow-redirects-1.13.3.tgz	Transitive	5.0.0	✅	Reachable
WS-2021-0153	Critical	9.8	Not Defined		ejs-2.7.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-42282	Critical	9.8	Not Defined	0.1%	ip-1.1.5.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-37601	Critical	9.8	Not Defined	2.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-29078	Critical	9.8	Not Defined	47.5%	ejs-2.7.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-0691	Critical	9.8	Not Defined	0.4%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-42740	Critical	9.8	Not Defined	0.70000005%	shell-quote-1.7.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3918	Critical	9.8	Not Defined	0.2%	json-schema-0.2.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3757	Critical	9.8	Not Defined	0.3%	immer-8.0.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-45133	Critical	9.3	Not Defined	0.1%	traverse-7.13.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-48949	Critical	9.1	Not Defined	0.1%	elliptic-6.5.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-29415	Critical	9.1	Not Defined		ip-1.1.5.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-0686	Critical	9.1	Not Defined	0.2%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-33883	High	8.8	Not Defined	0.1%	ejs-2.7.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-37713	High	8.2	Not Defined	0.1%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-37712	High	8.2	Not Defined	0.2%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-37701	High	8.2	Not Defined	0.2%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32804	High	8.2	Not Defined	0.70000005%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32803	High	8.2	Not Defined	0.70000005%	tar-6.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-1650	High	8.1	Not Defined	0.2%	eventsource-1.0.7.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-43138	High	7.8	Not Defined	0.2%	async-2.6.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23386	High	7.7	Not Defined	0.1%	dns-packet-1.3.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-4068	High	7.5	Not Defined	0.0%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2024-37890	High	7.5	Not Defined	0.0%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-38900	High	7.5	Not Defined	0.5%	decode-uri-component-0.2.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-37603	High	7.5	Not Defined	1.5%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-37599	High	7.5	Not Defined	0.3%	loader-utils-2.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-3517	High	7.5	Not Defined	0.2%	minimatch-3.0.4.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-24999	High	7.5	Not Defined	1.4000001%	qs-6.5.2.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-24772	High	7.5	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-24771	High	7.5	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3807	High	7.5	Not Defined	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-3803	High	7.5	Not Defined	0.1%	nth-check-1.0.2.tgz	Transitive	N/A*	❌	Unreachable
CVE-2021-3777	High	7.5	Not Defined	0.1%	tmpl-1.0.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-29059	High	7.5	Not Defined	0.3%	is-svg-3.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-28092	High	7.5	Not Defined	0.3%	is-svg-3.0.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-27290	High	7.5	Not Defined	0.3%	ssri-6.0.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23424	High	7.5	Proof of concept	0.2%	ansi-html-0.0.7.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-29180	High	7.4	Not Defined	0.0%	webpack-dev-middleware-3.7.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-46175	High	7.1	Not Defined	0.8%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
WS-2022-0008	Medium	6.6	Not Defined		node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-28863	Medium	6.5	Not Defined	0.0%	tar-6.1.0.tgz	Transitive	N/A*	❌	Unreachable
CVE-2023-46234	Medium	6.5	Not Defined	0.2%	browserify-sign-4.2.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-26136	Medium	6.5	Proof of concept	0.5%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2024-43788	Medium	6.4	Not Defined	0.1%	webpack-4.44.2.tgz	Transitive	N/A*	❌	Unreachable
CVE-2024-47068	Medium	6.1	Not Defined	0.1%	rollup-1.32.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2023-28155	Medium	6.1	Not Defined	0.1%	request-2.88.2.tgz	Transitive	N/A*	❌	Unreachable
CVE-2022-0122	Medium	6.1	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23436	Medium	5.6	Proof of concept	0.6%	immer-8.0.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-4067	Medium	5.3	Not Defined	0.0%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2023-44270	Medium	5.3	Not Defined	0.1%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2023-26115	Medium	5.3	Proof of concept	0.3%	word-wrap-1.2.3.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-25883	Medium	5.3	Proof of concept	0.5%	detected in multiple dependencies	Transitive	N/A*	❌	Unreachable
CVE-2022-25858	Medium	5.3	Not Defined	0.4%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2022-24773	Medium	5.3	Not Defined	0.1%	node-forge-0.10.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-0639	Medium	5.3	Not Defined	0.1%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2022-0512	Medium	5.3	Not Defined	0.1%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-3664	Medium	5.3	Not Defined	0.1%	url-parse-1.5.1.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-32640	Medium	5.3	Not Defined	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23382	Medium	5.3	Not Defined	0.2%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23368	Medium	5.3	Not Defined	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23364	Medium	5.3	Proof of concept	0.3%	detected in multiple dependencies	Transitive	5.0.0	✅	Unreachable
CVE-2021-23362	Medium	5.3	Proof of concept	0.3%	hosted-git-info-2.8.4.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23343	Medium	5.3	Not Defined	0.3%	path-parse-1.0.6.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2020-28469	Medium	5.3	Not Defined	0.8%	glob-parent-3.1.0.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2021-23566	Medium	4.0	Proof of concept	0.1%	nanoid-3.1.22.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-27088	Low	0.0	Not Defined	0.0%	es5-ext-0.10.53.tgz	Transitive	5.0.0	✅	Unreachable
CVE-2024-21538	High	7.5	Proof of concept	0.0%	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-21536	High	7.5	Proof of concept	0.1%	http-proxy-middleware-0.19.1.tgz	Transitive	N/A*	❌
CVE-2024-11831	Medium	5.4	Not Defined	0.1%	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2024-48948	Medium	4.8	Not Defined	0.0%	elliptic-6.5.4.tgz	Transitive	N/A*	❌
CVE-2024-55565	Medium	4.3	Not Defined	0.0%	nanoid-3.1.22.tgz	Transitive	5.0.0	✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (11 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2023-26159

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.

Publish Date: 2024-01-02

URL: CVE-2023-26159

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 0.1%

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159

Release Date: 2024-01-02

Fix Resolution (follow-redirects): 1.15.4

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28849

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.0%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution (follow-redirects): 1.15.6

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0155

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0536

Vulnerable Library - follow-redirects-1.13.3.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.1.tgz
        • ❌ follow-redirects-1.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

This vulnerability is potentially reachable

insights-dashboard-sample-0.1.1/src/index.js (Application)
  -> axios-0.21.1/index.js (Extension)
   -> axios-0.21.1/lib/axios.js (Extension)
    -> axios-0.21.1/lib/defaults.js (Extension)
     -> axios-0.21.1/lib/adapters/http.js (Extension)
      -> ❌ follow-redirects-1.13.3/index.js (Vulnerable Component)

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (2.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2021-0153

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • workbox-webpack-plugin-5.1.4.tgz
    • workbox-build-5.1.4.tgz
      • rollup-plugin-off-main-thread-1.4.2.tgz
        • ❌ ejs-2.7.4.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Arbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.

Publish Date: 2021-01-22

URL: WS-2021-0153

Threat Assessment

Exploit Maturity: Not Defined

EPSS:

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-01-22

Fix Resolution (ejs): 3.1.6

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-42282

Vulnerable Library - ip-1.1.5.tgz

[](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-37601

Vulnerable Libraries - loader-utils-1.4.0.tgz, loader-utils-1.2.3.tgz, loader-utils-2.0.0.tgz

loader-utils-1.4.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/html-webpack-plugin/node_modules/loader-utils/package.json,/node_modules/webpack/node_modules/loader-utils/package.json,/node_modules/babel-loader/node_modules/loader-utils/package.json,/node_modules/mini-css-extract-plugin/node_modules/loader-utils/package.json,/node_modules/postcss-loader/node_modules/loader-utils/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • html-webpack-plugin-4.5.0.tgz
    • ❌ loader-utils-1.4.0.tgz (Vulnerable Library)

loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/resolve-url-loader/node_modules/loader-utils/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • resolve-url-loader-3.1.2.tgz
    • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

loader-utils-2.0.0.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • resolve-url-loader-3.1.2.tgz
    • adjust-sourcemap-loader-3.0.0.tgz
      • ❌ loader-utils-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

Publish Date: 2022-10-12

URL: CVE-2022-37601

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 2.3%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-29078

Vulnerable Library - ejs-2.7.4.tgz

Embedded JavaScript templates

Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ejs/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • workbox-webpack-plugin-5.1.4.tgz
    • workbox-build-5.1.4.tgz
      • rollup-plugin-off-main-thread-1.4.2.tgz
        • ❌ ejs-2.7.4.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).

Publish Date: 2022-04-25

URL: CVE-2022-29078

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 47.5%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~

Release Date: 2022-04-25

Fix Resolution (ejs): 3.1.7

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0691

Vulnerable Library - url-parse-1.5.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • webpack-dev-server-3.11.1.tgz
    • sockjs-client-1.5.0.tgz
      • ❌ url-parse-1.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-42740

Vulnerable Library - shell-quote-1.7.2.tgz

quote and parse shell commands

Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.7.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shell-quote/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • react-dev-utils-11.0.4.tgz
    • ❌ shell-quote-1.7.2.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

The shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.

Publish Date: 2021-10-21

URL: CVE-2021-42740

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.70000005%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740

Release Date: 2021-10-21

Fix Resolution (shell-quote): 1.7.3

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy:

• react-scripts-4.0.3.tgz (Root Library)
  • jest-26.6.0.tgz
    • jest-cli-26.6.3.tgz
      • jest-config-26.6.3.tgz
        • jest-environment-jsdom-26.6.2.tgz
          • jsdom-16.5.1.tgz
            • request-2.88.2.tgz
              • http-signature-1.2.0.tgz
                • jsprim-1.4.1.tgz
                  • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 7f1b16462576aa26c3583688661bd85b83d15df1

Found in base branch: main

Reachability Analysis

The vulnerable code is unreachable

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.2%

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (react-scripts): 5.0.0

⛑️ Automatic Remediation will be attempted for this issue.

---

⛑️Automatic Remediation will be attempted for this issue.

[mend-for-github-com]

✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.

[mend-for-github-com]

ℹ️ This issue was automatically re-opened by Mend because the vulnerable library in the specific branch(es) has been detected in the Mend inventory.