PT-2019-13824 · Verdaccio · Verdaccio

Evilpacket · Publicado 2019-05-29 · Atualizado 2019-08-13 · CVE-2019-14772

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions verdaccio versions prior to 3.12.0

Description The issue is a Cross-Site Scripting (XSS) vulnerability, where malicious packages with JavaScript content can be executed in the User Interface, potentially stealing user credentials.

Recommendations For versions prior to 3.12.0, upgrade to version 3.12.0 or later, or migrate to a major version 4.0.0 or later to fix the issue. At the moment, there is no workaround available without upgrading.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-14772

GHSA-78J5-GCMF-VQC8

Produtos afetados

Verdaccio

Referências · 7

• 🔥 https://github.com/verdaccio/verdaccio/security/advisories/GHSA-78j5-gcmf-vqc8 · Exploit
• https://github.com/verdaccio/verdaccio · Nota
• https://osv.dev/vulnerability/GHSA-78j5-gcmf-vqc8 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-14772 · Aviso do Fabricante
• https://npmjs.com/advisories/832 · Nota
• https://npmjs.com/advisories/833 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-14772 · Nota de Segurança