CVE-2019-16776 Unauthorized File Access in npm CLI before before version 6.13.3

🗓️ 13 Dec 2019 00:55:16Reported by GitHub_MType

CVE-2019-16776 Unauthorized File Access in npm CL

Reporter	Title	Published	Views	Family All 106
IBM Security Bulletins	Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager HA	30 Jul 202121:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js	17 May 202320:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR	30 Jul 202121:12	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
FreeBSD	NPM -- Multiple vulnerabilities	18 Dec 201900:00	–	freebsd
AlmaLinux	nodejs:12 enhancement update	4 Feb 202008:35	–	almalinux
AlmaLinux	Important: nodejs:10 security update	25 Feb 202007:57	–	almalinux
BDU FSTEC	The vulnerability of the command-line tools for package managers NPM and Yarn allows a hacker to write arbitrary files.	17 Dec 201900:00	–	bdu_fstec
Tenable Nessus	CentOS 8 : nodejs:10 (CESA-2020:0579)	1 Feb 202100:00	–	nessus
Tenable Nessus	Fedora 31 : 1:libuv / 1:nodejs (2020-595ce5e3cc)	27 Jan 202000:00	–	nessus

[
  {
    "product": "cli",
    "vendor": "npm",
    "versions": [
      {
        "lessThan": "6.13.3",
        "status": "affected",
        "version": "< 6.13.3",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
github	www.github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46
access	www.access.redhat.com/errata/RHEA-2020:0330
blog	www.blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
access	www.access.redhat.com/errata/RHSA-2020:0579
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
access	www.access.redhat.com/errata/RHSA-2020:0602
access	www.access.redhat.com/errata/RHSA-2020:0573
access	www.access.redhat.com/errata/RHSA-2020:0597
oracle	www.oracle.com/security-alerts/cpujan2020.html

07 Apr 2020 18:33Current

7.9High risk

Vulners AI Score7.9

CVSS 3.17.7

EPSS0.03342

CWE-22