PT-2020-14180 · Npm+6 · Npm Cli+6
Claudiahdz
·
Published
2020-07-07
·
Updated
2024-06-15
·
CVE-2020-15095
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
npm CLI versions prior to 6.14.6
Description
The issue concerns an information exposure vulnerability through log files. The npm CLI supports URLs in the format of
<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>. However, the password value is not redacted and is printed to stdout and also to any generated log files. This could potentially expose sensitive information.Recommendations
For versions prior to 6.14.6, update to version 6.14.6 or later to resolve the issue. As a temporary workaround, consider restricting access to log files to minimize the risk of information exposure. Avoid using the
password variable in URLs until the issue is resolved.Fix
Insertion into Log File
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Almalinux
Centos
Red Hat
Rocky Linux
Suse
Npm Cli