CVE-2019-16775

🗓️ 13 Dec 2019 01:15:10Reported by [email protected]Type

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write, allowing packages to create symlinks to files outside the node_modules folder upon installation

Reporter	Title	Published	Views	Family All 107
IBM Security Bulletins	Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager HA	30 Jul 202121:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	8 Jun 202321:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected but not classified as vulnerable to multiple vulnerabilities in Node.js	17 May 202320:51	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in npm affects IBM VM Recovery Manager DR	30 Jul 202121:12	–	ibm
IBM Security Bulletins	Security Bulletin: Medium/low severity vulnerabilities in libraries used by IBM Spectrum Discover (libraries of libraries)	27 Apr 202222:51	–	ibm
FreeBSD	NPM -- Multiple vulnerabilities	18 Dec 201900:00	–	freebsd
AlmaLinux	nodejs:12 enhancement update	4 Feb 202008:35	–	almalinux
AlmaLinux	Important: nodejs:10 security update	25 Feb 202007:57	–	almalinux
BDU FSTEC	The vulnerability of the command-line tools for package managers NPM and Yarn allows a hacker to write arbitrary files.	17 Dec 201900:00	–	bdu_fstec
Tenable Nessus	CentOS 8 : nodejs:10 (CESA-2020:0579)	1 Feb 202100:00	–	nessus

NVD

Node

redhat enterprise_linuxMatch8.0

redhat enterprise_linux_eusMatch8.1

Node

npmjs npmRange<6.13.3

Node

opensuse leapMatch15.1

Node

oracle graalvmMatch19.3.0.2enterprise

oracle graalvmMatch20.3.3enterprise

oracle graalvmMatch21.2.2enterprise

Node

fedoraproject fedoraMatch31

Source	Link
access	www.access.redhat.com/errata/RHSA-2020:0573
oracle	www.oracle.com/security-alerts/cpujan2020.html
lists	www.lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html
access	www.access.redhat.com/errata/RHSA-2020:0602
blog	www.blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/
access	www.access.redhat.com/errata/RHSA-2020:0579
oracle	www.oracle.com/security-alerts/cpuoct2021.html
access	www.access.redhat.com/errata/RHSA-2020:0597
access	www.access.redhat.com/errata/RHEA-2020:0330

21 Nov 2024 04:31Current

7.7High risk

Vulners AI Score7.7

CVSS 24

CVSS 3.16.5 - 7.7

EPSS0.0115