Lucene search

[email protected]CVE-2019-16777

HistoryDec 13, 2019 - 1:15 a.m.

CVE-2019-16777

2019-12-1301:15:00

CWE-269

[email protected]

web.nvd.nist.gov

299

npm

cli

vulnerability

arbitrary file overwrite

package installations

global install

serve binary

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

6.7 Medium

AI Score

Confidence

High

5.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:N/I:P/A:P

0.002 Low

EPSS

Percentile

55.9%

JSON

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

CPENameOperatorVersion
npmjs:npmnpmjs npmlt6.13.4
opensuse:leapopensuse leapeq15.1
oracle:graalvmoracle graalvmeq19.3.0.2
fedoraproject:fedorafedoraproject fedoraeq31
redhat:enterprise_linuxredhat enterprise linuxeq8.0
redhat:enterprise_linux_eusredhat enterprise linux euseq8.1

CPE	Name	Operator	Version
npmjs:npm	npmjs npm	lt	6.13.4
opensuse:leap	opensuse leap	eq	15.1
oracle:graalvm	oracle graalvm	eq	19.3.0.2
fedoraproject:fedora	fedoraproject fedora	eq	31
redhat:enterprise_linux	redhat enterprise linux	eq	8.0
redhat:enterprise_linux_eus	redhat enterprise linux eus	eq	8.1