CVE-2021-39135

🗓️ 31 Aug 2021 17:10:10Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 153 Views

`CVE-2021-39135: @npmcli/arborist allows arbitrary write to file system via symbolic link

Reporter	Title	Published	Views	Family All 107
ALT Linux	Security fix for the ALT Linux 10 package node version 14.17.6-alt1	1 Sep 202100:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - Node.js (CVE-2021-39135)	22 Apr 202219:30	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Node.js	29 Oct 202121:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container Integration Servers may be vulnerable to a symlink attack due to CVE-2021-39135	7 Oct 202110:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security Verify Governance is vulnerable to multiple security issues due to Node.js	22 Aug 202215:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect IBM Rational® Application Developer for WebSphere® Software - September 2021	16 Nov 202119:42	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Rational Application Developer for WebSphere Software included in Rational Developer for i	12 Dec 202119:49	–	ibm
IBM Security Bulletins	Security Bulletin: There are multiple vulnerabilites that affect IBM Engineering Requirements Quality Assistant On-Premises	22 May 202314:23	–	ibm
IBM Security Bulletins	Security Bulletin: High severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:57	–	ibm
FreeBSD	Node.js -- August 2021 Security Releases (2)	31 Aug 202100:00	–	freebsd

NVD

Vulners

Node

npmjs arboristRange<2.8.2node.js

AND

npmjs npmRange<7.20.7

Node

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.0enterprise

Node

siemens sinec_infrastructure_network_servicesRange<1.0.1.1

[
  {
    "product": "arborist",
    "vendor": "npm",
    "versions": [
      {
        "status": "affected",
        "version": "< 2.8.2"
      }
    ]
  }
]

Source	Link
npmjs	www.npmjs.com/package/%40npmcli/arborist
github	www.github.com/npm/arborist/security/advisories/GHSA-gmw6-94gg-2rc2
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
oracle	www.oracle.com/security-alerts/cpuoct2021.html

21 Nov 2024 06:18Current

6.7Medium risk

Vulners AI Score6.7

CVSS 24.4

CVSS 3.17.8 - 8.2

EPSS0.00211