PT-2020-21376 · Npm · Npm-Registry-Fetch

Published 2020-07-07 · Updated 2020-07-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions npm-registry-fetch (affected versions not specified)

Description The issue concerns an information exposure through log files. The npm-registry-fetch cli supports URLs with a specific format, including protocol, user, password, hostname, port, and path. However, the password value is not properly redacted and is printed to both stdout and any generated log files.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

GHSA-JMQM-F2GX-4FJV

Affected Products

Npm-Registry-Fetch

References · 6

• https://osv.dev/vulnerability/GHSA-jmqm-f2gx-4fjv · Vendor Advisory
• https://github.com/npm/npm-registry-fetch · Note
• https://github.com/npm/npm-registry-fetch/security/advisories/GHSA-jmqm-f2gx-4fjv · Note
• https://github.com/npm/npm-registry-fetch/pull/29 · Note
• https://github.com/npm/npm-registry-fetch/commit/18bf9b97fb1deecdba01ffb05580370846255c88 · Note
• https://snyk.io/vuln/SNYK-JS-NPMREGISTRYFETCH-575432 · Note