Improper Package Validation

🗓️ 02 Aug 2023 11:16:01Reported by Veracode Vulnerability DatabaseType

Improper Package Validation vulnerability in pnpm tarball

Reporter	Title	Published	Views	Family All 28
GithubExploit	Exploit for Improper Access Control in Pnpm	24 Oct 202318:32	–	githubexploit
Circl	CVE-2023-37478	1 Aug 202309:12	–	circl
CNNVD	pnpm Access Control Error Vulnerability	1 Aug 202300:00	–	cnnvd
CVE	CVE-2023-37478	1 Aug 202311:43	–	cve
Cvelist	CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification	1 Aug 202311:43	–	cvelist
EUVD	EUVD-2023-2219	3 Oct 202520:07	–	euvd
Github Security Blog	pnpm incorrectly parses tar archives relative to specification	1 Aug 202317:00	–	github
NVD	CVE-2023-37478	1 Aug 202312:15	–	nvd
OSV	CVE-2023-37478 pnpm incorrectly parses tar archives relative to specification	1 Aug 202311:43	–	osv
OSV	GHSA-5R98-F33J-G8H7 pnpm incorrectly parses tar archives relative to specification	1 Aug 202317:00	–	osv

Vulners

Node

cafs @pnpm/cafsRange1.0.0-alpha.0–7.0.4js

exe @pnpm/exeRange8.0.0-alpha.0–8.6.7js

exe @pnpm/exeRange6.17.1–7.33.3js

linux-arm64 @pnpm/linux-arm64Range8.0.0-alpha.0–8.6.7js

linux-x64 @pnpm/linux-x64Range8.0.0-alpha.0–8.6.7js

macos-arm64 @pnpm/macos-arm64Range8.0.0-alpha.0–8.6.7js

macos-x64 @pnpm/macos-x64Range8.0.0-alpha.0–8.6.7js

win-x64 @pnpm/win-x64Range8.0.0-alpha.0–8.6.7js

win-x64 @pnpm/win-x64Range6.17.1–7.33.3js

pnpm pnpmRange8.0.0-alpha.0–8.6.7js

pnpm pnpmRange5.0.0-alpha.0–7.33.3js

Source	Link
github	www.github.com/pnpm/pnpm/commit/e92d23a2d0b761174146a066118cc9c70552e30d
github	www.github.com/pnpm/pnpm/releases/tag/v7.33.4
github	www.github.com/pnpm/pnpm/commit/250f7e9fe90359e2b3b01ba8294c4120445e5aa6
github	www.github.com/pnpm/pnpm/releases/tag/v8.6.8
github	www.github.com/advisories/GHSA-5r98-f33j-g8h7
github	www.github.com/pnpm/pnpm/security/advisories/GHSA-5r98-f33j-g8h7

04 Aug 2023 18:25Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5 - 9.8

EPSS0.00933

SSVC