cnvd - cnvd-2021-18231

cnvd-2021-18231

Vulnerability from cnvd

Title: npm CLI日志信息泄露漏洞

Description:

npm CLI是一款软件包管理器。

npm CLI 6.14.6之前的版本容易通过日志文件暴露信息漏洞。CLI支持诸如“：/[[：]@][：][：][/]”之类的URL。密码值未被编辑，并被打印到stdout和任何生成的日志文件中。目前没有详细漏洞细节提供。

Severity: 低

Patch Name: npm CLI日志信息泄露漏洞的补丁

Patch Description:

npm CLI是一款软件包管理器。

npm CLI 6.14.6之前的版本容易通过日志文件暴露信息漏洞。CLI支持诸如“：/[[：]@][：][：][/]”之类的URL。密码值未被编辑，并被打印到stdout和任何生成的日志文件中。目前没有详细漏洞细节提供。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp

Reference: https://packetstormsecurity.com/files/160022/Red-Hat-Security-Advisory-2020-5086-01.html

Impacted products

Name
npm CLI <6.14.6

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-15095"
    }
  },
  "description": "npm CLI\u662f\u4e00\u6b3e\u8f6f\u4ef6\u5305\u7ba1\u7406\u5668\u3002\n\nnpm CLI 6.14.6\u4e4b\u524d\u7684\u7248\u672c\u5bb9\u6613\u901a\u8fc7\u65e5\u5fd7\u6587\u4ef6\u66b4\u9732\u4fe1\u606f\u6f0f\u6d1e\u3002CLI\u652f\u6301\u8bf8\u5982\u201c\u003cprotocol\u003e\uff1a/[\u003cuser\u003e[\uff1a\u003cpassword\u003e]@]\u003chostname\u003e[\uff1a\u003cport\u003e][\uff1a][/]\u003cpath\u003e\u201d\u4e4b\u7c7b\u7684URL\u3002\u5bc6\u7801\u503c\u672a\u88ab\u7f16\u8f91\uff0c\u5e76\u88ab\u6253\u5370\u5230stdout\u548c\u4efb\u4f55\u751f\u6210\u7684\u65e5\u5fd7\u6587\u4ef6\u4e2d\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2021-18231",
  "openTime": "2021-03-17",
  "patchDescription": "npm CLI\u662f\u4e00\u6b3e\u8f6f\u4ef6\u5305\u7ba1\u7406\u5668\u3002\r\n\r\nnpm CLI 6.14.6\u4e4b\u524d\u7684\u7248\u672c\u5bb9\u6613\u901a\u8fc7\u65e5\u5fd7\u6587\u4ef6\u66b4\u9732\u4fe1\u606f\u6f0f\u6d1e\u3002CLI\u652f\u6301\u8bf8\u5982\u201c\u003cprotocol\u003e\uff1a/[\u003cuser\u003e[\uff1a\u003cpassword\u003e]@]\u003chostname\u003e[\uff1a\u003cport\u003e][\uff1a][/]\u003cpath\u003e\u201d\u4e4b\u7c7b\u7684URL\u3002\u5bc6\u7801\u503c\u672a\u88ab\u7f16\u8f91\uff0c\u5e76\u88ab\u6253\u5370\u5230stdout\u548c\u4efb\u4f55\u751f\u6210\u7684\u65e5\u5fd7\u6587\u4ef6\u4e2d\u3002\u76ee\u524d\u6ca1\u6709\u8be6\u7ec6\u6f0f\u6d1e\u7ec6\u8282\u63d0\u4f9b\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "npm CLI\u65e5\u5fd7\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "npm CLI \u003c6.14.6"
  },
  "referenceLink": "https://packetstormsecurity.com/files/160022/Red-Hat-Security-Advisory-2020-5086-01.html",
  "serverity": "\u4f4e",
  "submitTime": "2020-07-08",
  "title": "npm CLI\u65e5\u5fd7\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2020-15095 (GCVE-0-2020-15095)

Vulnerability from cvelistv5

Published

2020-07-07 18:55

Modified

2024-08-04 13:08

Severity ?

4.4 (Medium) - CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Summary

Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>". The password value is not redacted and is printed to stdout and also to any generated log files.

References

▼	URL	Tags
	https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp	x_refsource_CONFIRM
	https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc	x_refsource_MISC
	https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html	vendor-advisory, x_refsource_SUSE
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/	vendor-advisory, x_refsource_FEDORA
	https://security.gentoo.org/glsa/202101-07	vendor-advisory, x_refsource_GENTOO

Impacted products

	Vendor	Product	Version
	npm	cli	Version: < 6.14.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:08:21.646Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07"
          },
          {
            "name": "openSUSE-SU-2020:1616",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html"
          },
          {
            "name": "openSUSE-SU-2020:1644",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html"
          },
          {
            "name": "openSUSE-SU-2020:1660",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html"
          },
          {
            "name": "FEDORA-2020-43d5a372fc",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"
          },
          {
            "name": "GLSA-202101-07",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202101-07"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cli",
          "vendor": "npm",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 6.14.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "CWE-532: Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-11T10:06:12",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07"
        },
        {
          "name": "openSUSE-SU-2020:1616",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html"
        },
        {
          "name": "openSUSE-SU-2020:1644",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html"
        },
        {
          "name": "openSUSE-SU-2020:1660",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html"
        },
        {
          "name": "FEDORA-2020-43d5a372fc",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"
        },
        {
          "name": "GLSA-202101-07",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202101-07"
        }
      ],
      "source": {
        "advisory": "GHSA-93f3-23rq-pjfp",
        "discovery": "UNKNOWN"
      },
      "title": "Sensitive information exposure through logs in npm cli",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2020-15095",
          "STATE": "PUBLIC",
          "TITLE": "Sensitive information exposure through logs in npm cli"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "cli",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003c 6.14.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "npm"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like \"\u003cprotocol\u003e://[\u003cuser\u003e[:\u003cpassword\u003e]@]\u003chostname\u003e[:\u003cport\u003e][:][/]\u003cpath\u003e\". The password value is not redacted and is printed to stdout and also to any generated log files."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 4.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-532: Insertion of Sensitive Information into Log File"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp",
              "refsource": "CONFIRM",
              "url": "https://github.com/npm/cli/security/advisories/GHSA-93f3-23rq-pjfp"
            },
            {
              "name": "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc",
              "refsource": "MISC",
              "url": "https://github.com/npm/cli/commit/a9857b8f6869451ff058789c4631fadfde5bbcbc"
            },
            {
              "name": "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07",
              "refsource": "MISC",
              "url": "https://github.com/npm/cli/blob/66aab417f836a901f8afb265251f761bb0422463/CHANGELOG.md#6146-2020-07-07"
            },
            {
              "name": "openSUSE-SU-2020:1616",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00011.html"
            },
            {
              "name": "openSUSE-SU-2020:1644",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00015.html"
            },
            {
              "name": "openSUSE-SU-2020:1660",
              "refsource": "SUSE",
              "url": "http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00023.html"
            },
            {
              "name": "FEDORA-2020-43d5a372fc",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4OOYAMJVLLCLXDTHW3V5UXNULZBBK4O6/"
            },
            {
              "name": "GLSA-202101-07",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202101-07"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-93f3-23rq-pjfp",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2020-15095",
    "datePublished": "2020-07-07T18:55:12",
    "dateReserved": "2020-06-25T00:00:00",
    "dateUpdated": "2024-08-04T13:08:21.646Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted