PT-2019-7501 · Node.Js · Node-Cli

Published 2022-05-24 · Updated 2022-05-24 · CVE-2016-1000021

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions node-cli versions 0.1.0 through 0.11.3

Description An issue exists due to predictable temporary file names in lock file and log file, which allows an attacker to overwrite files.

Recommendations For node-cli versions 0.1.0 through 0.11.3, consider updating to a version where this issue is resolved, however, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the temporary files generated by lock file and log file to minimize the risk of exploitation.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2016-1000021

GHSA-3MRP-QHCJ-MWV5

Affected Products

Node-Cli

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2016-1000021 · Security Note
• https://osv.dev/vulnerability/GHSA-3mrp-qhcj-mwv5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-10538 · Security Note
• https://github.com/node-js-libs/cli/issues/81 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-1000021 · Note
• https://web.archive.org/web/20190430172230/https://npmjs.com/advisories/95 · Note